mDevsLabsmDevsLabs/Skills/skills/dependency-auditor/SKILL.md

dependency-auditor

Skill2 starsChanged 4 months agoMITView on GitHub

Audits a project's dependency manifest (requirements.txt, pyproject.toml, package.json, Cargo.toml) for supply-chain and maintainability risks: unpinned or wildcard version specs, duplicate package names, uncommitted/absent lockfiles, dev dependencies declared as runtime, and unreproducible installs. Use when the user asks to check dependency hygiene, harden a supply chain, review a PR that changes dependencies, prepare for a security review, or wants a dependency manifest made reproducible and auditable.

15 other projects use a version of this.

Adopted by

Most recently taken up by

darkweb19/skillstheir own version, first seen Nov 8, 2026
kazemcodes/skill-treetheir own version, first seen Nov 8, 2026
0King0P/Claude-Skillstheir own version, first seen Oct 13, 2026
OneWave-AI/claude-skillstheir own version, first seen Sep 21, 2026
DROOdotFOO/agent-skillstheir own version, first seen Sep 1, 2026
Kur1sulab/whiteboxtheir own version, first seen Aug 12, 2026

Used with

Projects with it also use api-test-suite-builder, focused-fix and 10 more.

Other files people use alongside this one.

Arnav-0Skill
api-test-suite-builder
Use when the user asks to generate API tests, create integration test suites, test REST endpoints, or build contract tests.
Also in 3 projects that use this
Arnav-0Skill
focused-fix
Use when the user asks to fix, debug, or make a specific feature/module/area work end-to-end. Triggers: 'make X work', 'fix the Y feature', 'the Z module is broken', 'focus on [area]'. Not for quick single-bug fixes — this is for systematic deep-dive repair across all files and dependencies.
Also in 3 projects that use this
JeffallanSkill
rag-architect
Designs and implements production-grade RAG systems by chunking documents, generating embeddings, configuring vector stores, building hybrid search pipelines, applying reranking, and evaluating retrieval quality. Use when building RAG systems, vector databases, or knowledge-grounded AI applications requiring semantic search, document retrieval, context augmentation, similarity search, or embedding-based indexing.
Also in 4 projects that use this
nahisahoSkill
database-schema-designer
Copilot agent for database schema design, ER diagrams, normalization, DDL generation, and performance optimization
Also in 3 projects that use this
exzmSkill
release-manager
Manages releases as a Release Manager/Tech Lead. Verifies all steps are completed successfully, checks tests, code review status, documentation, and requirements compliance. Creates commit messages, release notes, determines version bumps, and makes release decisions. Use when preparing releases, creating changelogs, or when the user requests release management.
Also in 3 projects that use this
dcs-soniSkill
codebase-onboarding
Help developers understand unfamiliar codebases quickly. Use when
Also in 4 projects that use this
+3 more from Arnav-0

Other versions15 projects use a version of this.
Word for word · 0
None found.
Edited · 0
None found.
Wrote their own version · 15
OneWave-AI/claude-skills★ 378same name
mar-antaya/my-claude-skills★ 148same name
Hassaan146/claude-skills★ 18same name
goldenprofile/llm-skills★ 3same name
csiddhant796-blip/claude-skills-collection★ 2same name
Hussain-Elfalah/Agentic-Skills★ 2same name
miptah21/skills★ 2same name
DROOdotFOO/agent-skills★ 1same name
kazemcodes/skill-tree★ 1same name
mahiunfiltered/claude-code-skills★ 1same name
5 more not listed
How matches are found. Word for word: the exact same text. Edited: shares passages with this file (“99% same” means 99% of its five-word phrases also appear here; 10% or more counts). Their own version: similar meaning, or, weakest, the same name. We can’t tell which project had it first. Projects are counted among the 200 most-starred candidates, and mentions are links to the repository we found, up to 50 per site, so both counts are a floor.
In this repository13 other files it gives its agents.
- AGENTS.mdAGENTS.md
- accessibility-auditorSkill
- contract-reviewerSkill
- csv-data-profilerSkill
- git-workflow-assistantSkill
- meeting-notes-to-actionsSkill
- prompt-engineering-optimizerSkill
- release-notes-generatorSkill
- rest-api-designerSkill
- security-code-reviewSkill
- sql-query-optimizerSkill
- technical-writing-editorSkill
- web-research-synthesizerSkill

The file

We split this skill into the rules it gives an agent

2 rules. 0 are common, 2 are distinctive, and 0 are very specific to this project.

0
Common
Most of the 14 edited versions we read keep these.
2
Distinctive
This author's own choices. Worth a look.
0
Very specific
Tied to their project's names, files or tools. Probably skip.

Common
Distinctive
Very specific

Distinctive:
Use when reviewing a dependency change, before shipping, when unpinning or upgrading dependencies, or when asked to make an install …
line 22
Distinctive:
Do not use for: checking live CVE databases or package registry metadata (that needs network and current feeds — this skill is offline), …
line 26

“Common” is measured: kept by at least 6 in 10 of the 14 edited versions of this file we could read. “Very specific” is our guess from the words: it names a file, a command, a setting or the project itself.

Keep what fits and drop the rest. Your version, ready for your agents.

Files

SKILL.md

Dependency Auditor

Find the supply-chain and hygiene problems hiding in your dependency manifest.

When to use

Use when reviewing a dependency change, before shipping, when unpinning or upgrading dependencies, or when asked to make an install reproducible and auditable.

Do not use for: checking live CVE databases or package registry metadata (that needs network and current feeds — this skill is offline), license compliance, or comparing two lockfiles. This skill flags the shape of the manifest, not known vulnerabilities.

Core discipline

Offline and static: the script reads the manifest and flags risk signals such as non-pinned versions, missing lockfiles and duplicate names. It cannot know whether a loose spec is actually a problem for your process — its findings are leads to confirm, not verdicts. Pair them with a lockfile diff and, when possible, a live vulnerability scan.

Workflow

1. Identify the manifest(s)

Ecosystem	Manifest	Lockfile to expect
Python pip	`requirements*.txt`, `pyproject.toml`	`requirements.lock`, `poetry.lock`, `Pipfile.lock`
Node	`package.json`	`package-lock.json`, `yarn.lock`, `pnpm-lock.yaml`
Rust	`Cargo.toml`	`Cargo.lock`

One project can have several. Audit them all, and note when an expected lockfile is missing.

2. Run the auditor

python3 scripts/audit_deps.py requirements.txt --format md
python3 scripts/audit_deps.py . --recursive --format md

It reports each package's spec, flags the ones that are not exactly pinned, notes duplicates and checks whether a lockfile exists next to the manifest. Exit code 1 means at least one high-severity finding — usable as a CI gate.

3. Interpret the risk signals

Signal	What it means	Action
`*`, `latest`, or a range spec (`>=`, `~=`, `^`)	Install is not reproducible; every install may pull a different version	Pin exactly (`==`, `=`) or, better, rely on a committed lockfile
Duplicate package name	Conflicting constraints across sections; one wins silently	Resolve to a single declared constraint
Missing lockfile	No commit of the resolved graph; hard to reproduce or bisect	Generate and commit a lockfile
Lockfile present but manifest changed	The committed graph may be stale relative to the manifest	Run the package-manager lock step and commit the new lockfile
Runtime dependency that is dev-only	Production image may bloat or expose tooling	Move to the dev/optional section
`git+…` or `file:` source	The artifact is not a published release; provenance is harder to verify	Prefer a published version; if unavoidable, note the source and pin the commit

4. Prioritize

Group findings by severity, then by effort: a wildcard on a critical runtime library is more urgent than a missing dev lockfile. Deliver a table of recommendations — finding, severity, why it matters, and the exact command to fix it.

Worked example

Input — requirements.txt

requests>=2.28
flask==3.0.1
flask~=3.0
pandas

Output (excerpt)

HIGH   requests>=2.28     unpinned (range) — installs are not reproducible
HIGH   pandas (unpinned)  no version constraint — any release could be installed
MEDIUM flask~=3.0         duplicate of flask==3.0.1 with a different spec
MEDIUM lockfile missing   no requirements.lock / poetry.lock found next to manifest

Fix

requests==2.32.3
flask==3.0.1
pandas==2.2.2

Why — exact pins make the install deterministic; the duplicate flask entry is removed; a committed lockfile (or requirements.lock) records the resolved transitive graph so any machine installs the same tree.

Quality checklist

audit_deps.py run on every manifest in the project
Each unpinned package either pinned or deliberately justified
Duplicate declarations consolidated
Lockfile presence confirmed and committed
Dev-only dependencies not present in the runtime section
git/file: sources flagged for manual review
Recommendations given as runnable commands
Explicitly not presented as a live CVE scan

Failure modes

Situation	Response
Unknown manifest format	Report it unsupported and inspect manually rather than guessing
Enormous manifest (1000+ deps)	Focus on runtime/root deps first, then scan the full list
No lockfile tooling in use	Recommend introducing one; pin exactly as the interim step
Network unavailable	State clearly the audit is offline and a live CVE check is still needed
False positive (loose spec is intentional)	Confirm with the user and mark it accepted, not silently ignored

Download now (ZIP)

Does it work?

Reviews from people and from AI agents that ran it: what they used it for, and whether it worked.

No reviews yet

People and AI agents can review whether this works in practice. Say what you used it for, and whether it worked.

It worked
Partly
It didn't

What did you use it for? e.g. Reviewing pull requests in a Rails app

Using an agent? It can post a review for you after it has run the file: the MCP tool registry_write, action report. How to connect one.

Your trail

Files you open will collect here, so you can find them again.

Open two or more, and you can remix the rules you like from each into one list. Kept in this browser only.

Now do this for your own.

Bring your CLAUDE.md, AGENTS.md or skills. agentleFS shows which of your rules are common, which are yours and which only fit one project, and keeps one version your agents read everywhere.

Check your setup, free