CtrlK
BlogDocsLog inGet started
Tessl Logo

dependency-auditor

Audit and manage dependencies across multi-language projects. Identifies vulnerabilities, license conflicts, transitive dependency risks, and safe-upgrade paths. Use when auditing third-party packages before release, investigating a CVE, planning a major version bump, or running a license-compliance review. Examples: 'audit our npm dependencies', 'do we have GPL contamination', 'plan the upgrade to React 19'.

73

Quality

92%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

SecuritybySnyk

Passed

No findings from the security scan

The canonical home for this skill is dependency-auditor in alirezarezvani/claude-skills

SKILL.md
Quality
Evals
Security

Quality

Content

85%Weight 40%Scale 1-5

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

The body is well-structured, executable, and includes a real validation feedback loop for the upgrade workflow. Its main weakness is progressive disclosure: it points readers to scripts, references, fixtures, and a README that are not present in the bundle.

Suggestions

Ship the referenced bundle files (scripts/dep_scanner.py, scripts/license_checker.py, scripts/upgrade_planner.py, README.md, references/) so the SKILL.md navigation resolves, or remove references to files that are not provided.

Either include test-project/, test-inventory.json, and expected_outputs/ or drop the 'Sample fixtures' line to avoid pointing Claude at missing fixtures.

Trim the prose in 'Best Practices' and 'Scripts (accurate capability claims)' into tighter bullets to lift conciseness toward a 5.

DimensionReasoningScore

Conciseness

The body is efficient — compact tables, executable commands, and non-obvious context ('they do not call live advisory APIs') — with only minor descriptive prose (Best Practices list, capability-claims paragraph) that could be trimmed.

4 / 5

Actionability

Quick Start gives copy-paste-ready commands with specific flags and pipelined outputs (scan.json → plan.json), and CI Integration provides a second executable block covering the common cases.

5 / 5

Workflow Clarity

A clear 3-step scan → license → plan sequence is paired with an explicit feedback loop: 'after applying upgrades, re-run step 1 and assert 0 high-severity findings before closing the audit.'

5 / 5

Progressive Disclosure

Sections are well-organized and references to README.md and references/ are clearly signaled at one level deep, but every referenced bundle file (scripts/, references/, README.md, test-project/, expected_outputs/) is absent, so the promised navigation does not actually work.

3 / 5

Total

17

/

20

Passed

Description

100%Weight 40%Scale 1-5

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

The description is exemplary: it states concrete capabilities in third person, provides explicit 'Use when…' trigger guidance with realistic user-quoted examples, and carves out a distinct, low-conflict niche. It does not over-claim or pad.

DimensionReasoningScore

Specificity

Lists multiple concrete actions — 'Audit and manage dependencies', 'Identifies vulnerabilities, license conflicts, transitive dependency risks, and safe-upgrade paths' — giving comprehensive coverage of the skill's capabilities.

5 / 5

Completeness

Explicitly answers both what ('audit and manage dependencies…identifies vulnerabilities, license conflicts…') and when ('Use when auditing third-party packages before release, investigating a CVE…') with concrete trigger phrases.

5 / 5

Trigger Term Quality

Includes natural phrases users would actually say — 'audit our npm dependencies', 'do we have GPL contamination', 'plan the upgrade to React 19' — plus synonyms like CVE, major version bump, and license-compliance review.

5 / 5

Distinctiveness Conflict Risk

Occupies a clear niche (multi-language dependency auditing/security) with distinct triggers like 'GPL contamination' and CVE investigation, minimizing overlap with other skills.

5 / 5

Total

20

/

20

Passed

Validation

87%

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation14 / 16 Passed

Validation for skill structure

CriteriaDescriptionResult

relative_links

Relative link issues: 1 missing

Warning

referenced_paths_exist

Referenced path issues: 8 missing

Warning

Total

14

/

16

Passed

Repository
alirezarezvani/claude-skills
Reviewed

Table of Contents

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.