linea-dependency-maintenance

Safely plan and execute dependency maintenance for JavaScript/TypeScript (npm, pnpm) and GitHub Actions, including npm lockfiles, pnpm workspaces, catalogs, overrides, SHA-pinned action versions, release-age policies, audits, CI validation, Dependabot boundaries, PRs, and GitHub tracking issues. Use whenever the user asks to update, bump, refresh, audit, clean, modernize, or review dependencies or GitHub Actions, reduce vulnerabilities, clean overrides, or prepare dependency PRs/issues.

1.45x

Quality

88%

Does it follow best practices?

Impact

90%

1.45x

Average score across 1 eval scenario

Securityby

Passed

No findings from the security scan

Quality

Content

77%Weight 40%Scale 1-5

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

A well-structured, actionable dependency-maintenance workflow with strong sequencing, validation feedback loops, and clean progressive disclosure into real reference and script files. Its main weakness is repetition of the maturity-gate policy, which inflates token cost without adding clarity.

Suggestions

Consolidate the minimumReleaseAge / minimumReleaseAgeExclude 'hard gate, never bypass or widen' rule into a single canonical Policy statement and have the Overrides section reference it instead of restating the rationale and revert instructions multiple times.

Replace the <skill-dir> placeholder in command examples with a one-line note defining how to resolve it (or use a documented variable), so the inventory/Actions commands are copy-paste ready.

Trim the justifying clauses appended to policy bullets (e.g., 'A movable ref lets the upstream repo change what runs in CI without review', 'Floating ranges silently pull unreviewed releases...') to the essential rule, trusting Claude to understand the supply-chain risk.

Dimension	Reasoning	Score
Conciseness	The body is dense and operational without basic-concept padding, but the minimumReleaseAge 'hard gate / never widen minimumReleaseAgeExclude / revert audit-fix exclusions' rule is restated roughly four times across Policy and Overrides, which could be tightened into one canonical statement.	3 / 5
Actionability	Concrete executable commands (npm outdated --json, node <skill-dir>/scripts/eligible-updates --manager auto --days 3, eligible-actions --days 7) and a real SHA-bump diff example cover the common cases, with only minor placeholders like <skill-dir> and <package> keeping it from copy-paste perfection.	4 / 5
Workflow Clarity	A clearly sequenced Preflight→Policy→Inventory→Triage→Apply→Overrides→GitHub Actions→Validation→Open The PR flow with explicit validation checkpoints and feedback loops (baseline capture, blast-radius validation order, 'revert just that candidate', reinstall→audit fix→reinstall→re-audit→re-run validation).	5 / 5
Progressive Disclosure	SKILL.md is an overview that splits per-manager detail into one-level-deep, clearly signaled reference files (references/npm.md, pnpm.md, github-actions.md) plus bundled scripts, all verified to exist, with an 'Additional Resources' navigation section.	5 / 5
	Total	17 / 20 Passed

Description

100%Weight 40%Scale 1-5

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

A strong, third-person description that comprehensively names concrete capabilities and pairs them with an explicit, synonym-rich 'Use whenever...' trigger clause. It cleanly answers both what and when with minimal conflict risk.

Dimension	Reasoning	Score
Specificity	Lists multiple concrete actions and surfaces (npm lockfiles, pnpm workspaces, catalogs, overrides, SHA-pinned action versions, release-age policies, audits, CI validation, PRs, tracking issues), giving comprehensive coverage rather than vague language.	5 / 5
Completeness	It explicitly states both what the skill does ('Safely plan and execute dependency maintenance for JavaScript/TypeScript... and GitHub Actions') and when to use it ('Use whenever the user asks to...').	5 / 5
Trigger Term Quality	The 'Use whenever the user asks to update, bump, refresh, audit, clean, modernize, or review dependencies... reduce vulnerabilities, clean overrides, or prepare dependency PRs/issues' clause covers the natural synonyms users actually say.	5 / 5
Distinctiveness Conflict Risk	The npm/pnpm + GitHub Actions dependency-maintenance niche with SHA-pinning and release-age triggers is clearly distinct and unlikely to fire for unrelated skills.	5 / 5
	Total	20 / 20 Passed

Validation

93%

Warnings & errors only

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 15 / 16 Passed

Validation for skill structure

Criteria	Description	Result
metadata_version	'metadata.version' is missing	Warning

	Total	15 / 16 Passed

Repository: Consensys/linea-monorepo
Path: .agents/skills/linea-dependency-maintenance/SKILL.md
Commit: 24fa37a

Reviewed: 3 days ago

Table of Contents

Discovery Implementation Validation

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.