CtrlK
BlogDocsLog inGet started
Tessl Logo

update-deps

Audit and update npm/Bun dependencies with supply chain integrity checks — verifies maintainers, publish age, tarball diffs, and provenance before bumping. Defers risky packages to ~/.supply-chain/notes/.

68

Quality

81%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

SecuritybySnyk

Low

Low-risk findings worth noting

SKILL.md
Quality
Evals
Security

Quality

Content

88%Weight 40%Scale 1-5

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

The body is a highly actionable, well-sequenced workflow with strong validation and feedback loops for a batch/destructive operation. Conciseness and progressive disclosure are good but have minor room to improve.

Suggestions

Trim justifications Claude can infer (e.g. why Sonnet was chosen) to tighten conciseness toward a 5.

Move the sub-agent prompt template and the supply-chain-notes JSON schema into reference files under ./references/ and link to them, improving progressive disclosure for this over-50-line skill.

Add an explicit 'verify lockfile resolves after bump' checkpoint in Phase 3 to make the batch-operation validation fully explicit.

DimensionReasoningScore

Conciseness

Mostly efficient with direct commands and no explanation of basics Claude already knows, but includes minor over-explanation such as 'Sonnet is used here because these are independent, structured verification tasks that don't need heavier reasoning' that could be trimmed.

4 / 5

Actionability

Fully executable throughout — concrete `bun outdated`, `npm view`, `npm diff`, `gh release view`, and `bun update` commands plus a copy-paste-ready sub-agent prompt template and complete JSON schemas for the report and log.

5 / 5

Workflow Clarity

Four phases are clearly sequenced (discovery, integrity audit, execution, recap) with explicit validation before the batch bump (verdict classification), feedback loops (defer with review_by date, re-checking still-deferred packages), and a tier-classification checklist.

5 / 5

Progressive Disclosure

Well-organized with clear phase and sub-section headers and no nested references, but the large sub-agent prompt template and JSON log schema are inlined in a single ~190-line file rather than split into separate reference files.

4 / 5

Total

18

/

20

Passed

Description

75%Weight 40%Scale 1-5

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

The description is specific and distinctive, clearly conveying a supply-chain integrity audit niche with concrete actions. Its main weakness is the missing 'Use when...' trigger guidance, which caps completeness.

Suggestions

Add an explicit 'Use when ...' clause naming trigger phrases users would say (e.g. 'Use when updating npm or Bun dependencies, auditing outdated packages, or reviewing supply-chain risk').

Include common synonyms like 'packages', 'upgrade', 'outdated', and 'lockfile' to broaden trigger-term coverage.

Mention the lockfile explicitly since the body emphasizes 'touches the lockfile' as a key risk boundary.

DimensionReasoningScore

Specificity

Lists multiple concrete actions — 'Audit and update npm/Bun dependencies', 'verifies maintainers, publish age, tarball diffs, and provenance', 'Defers risky packages' — giving comprehensive coverage of the supply-chain audit workflow.

5 / 5

Completeness

The 'what' is explicit and detailed, but there is no 'Use when...' clause or equivalent trigger guidance, which per the judging guidelines caps completeness at 3.

3 / 5

Trigger Term Quality

Good keyword coverage with natural terms ('npm/Bun dependencies', 'supply chain integrity', 'bumping'), but missing common variations users might say like 'packages', 'upgrade', 'outdated', or 'lockfile'.

4 / 5

Distinctiveness Conflict Risk

A clear niche — supply-chain integrity verification for npm/Bun dependencies with maintainer/provenance/tarball checks — that is unlikely to trigger for the wrong skill.

5 / 5

Total

17

/

20

Passed

Validation

100%

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation16 / 16 Passed

Validation for skill structure

No warnings or errors.

Repository
backnotprop/plannotator
Reviewed

Table of Contents

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.