CtrlK
BlogDocsLog inGet started
Tessl Logo
SkillPublic

dependency-auditor

Audit and manage dependencies across multi-language projects. Identifies vulnerabilities, license conflicts, transitive dependency risks, and safe-upgrade paths. Use when auditing third-party packages before release, investigating a CVE, planning a major version bump, or running a license-compliance review. Examples: 'audit our npm dependencies', 'do we have GPL contamination', 'plan the upgrade to React 19'.

67

Quality

84%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide
SecuritybySnyk

Passed

No findings from the security scan

SKILL.md
Quality
Evals
Security

Quality

Content

71%Weight 40%Scale 1-5

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

The body is highly actionable with executable commands and a real verification loop, but it is held back by redundant general-knowledge sections that duplicate the license reference file, and by a bundle layer with multiple dangling references and unmentioned assets. Fixing the reference integrity and trimming the generic sections would raise this substantially.

Suggestions

Remove or fix the dangling references — README.md, test-project/, test-inventory.json, and expected_outputs/ do not exist in the bundle; either add those files or delete the mentions (line 68 and line 85).

Replace the generic "See references/" pointer with named links to the three actual reference files (vulnerability_assessment_guide.md, license_compatibility_matrix.md, dependency_management_best_practices.md), and either reference the assets/ sample manifests or remove them from the bundle.

Trim the License Classification taxonomy and generic Best Practices items (which restate knowledge Claude already has and duplicate the license compatibility matrix) down to skill-specific policy defaults, e.g. which --policy the scripts expect by default.

DimensionReasoningScore

Conciseness

Mostly efficient (compact tables, concrete flags), but the License Classification taxonomy and the four generic Best Practices items restate knowledge Claude already has and duplicate content that belongs in references/license_compatibility_matrix.md, so the body could be meaningfully tightened.

3 / 5

Actionability

Quick Start and CI Integration provide copy-paste-ready commands with real flags (--fail-on-high, --policy strict, --risk-threshold medium), plus explicit guidance on consuming scan.json/licenses.json/plan.json outputs — fully executable coverage of the common cases.

5 / 5

Workflow Clarity

A clear numbered 1-2-3 sequence with an explicit validation checkpoint ("re-run step 1 and assert 0 high-severity findings before closing the audit") covering the batch-upgrade risk, but there is no guidance on what to do when that verification loop fails (error-recovery/rollback steps are only implied by the planner's output).

4 / 5

Progressive Disclosure

Structure exists and references are one level deep, but four paths cited in the body do not exist in the bundle (README.md, test-project/, test-inventory.json, expected_outputs/), the references/ directory is cited generically without naming its three files, and assets/ (sample manifests) is never referenced at all — navigation is partially broken.

3 / 5

Total

15

/

20

Passed

Description

92%Weight 40%Scale 1-5

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

A strong description: concrete third-person capability statements, an explicit Use-when clause with scenario examples, and natural example utterances. Only minor keyword gaps (no file extensions or synonyms like "outdated packages") keep trigger coverage from the top anchor.

Suggestions

Add one or two common user synonyms or file-extension triggers (e.g., "outdated packages", "package.json", "requirements.txt") to lift trigger-term coverage to comprehensive.

Optionally note the offline/pattern-match nature of the tooling in the description so users expecting live CVE lookups are not misled.

DimensionReasoningScore

Specificity

Lists multiple concrete actions in third person — "Identifies vulnerabilities, license conflicts, transitive dependency risks, and safe-upgrade paths" — giving comprehensive, specific coverage of the skill's capabilities rather than vague domain language.

5 / 5

Completeness

Explicitly answers both questions: a clear "what" (audit and manage dependencies; identifies vulnerabilities, license conflicts, transitive risks, upgrade paths) and an explicit "Use when auditing third-party packages before release, investigating a CVE..." clause with concrete trigger phrases.

5 / 5

Trigger Term Quality

Strong natural triggers ("audit our npm dependencies", "do we have GPL contamination", "investigating a CVE") including example utterances, but misses common synonyms like "outdated packages" and file extensions (package.json, requirements.txt) that the top anchor expects.

4 / 5

Distinctiveness Conflict Risk

Occupies a clear niche (dependency auditing/license compliance) with distinct triggers like "GPL contamination" and "plan the upgrade to React 19"; unlikely to fire for unrelated skills.

5 / 5

Total

19

/

20

Passed

Validation

93%

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 15 / 16 Passed

Validation for skill structure

CriteriaDescriptionResult

relative_links

Relative link issues: 1 missing

Warning

Total

15

/

16

Passed

Repository

alirezarezvani/claude-skills

Path

engineering/skills/dependency-auditor/SKILL.md

Reviewed

Table of Contents

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.