CtrlK
BlogDocsLog inGet started
Tessl Logo

update-deps

Audit and update npm/Bun dependencies with supply chain integrity checks — verifies maintainers, publish age, tarball diffs, and provenance before bumping. Defers risky packages to ~/.supply-chain/notes/.

56

Quality

63%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

SecuritybySnyk

Low

Low-risk findings worth noting

Fix and improve this skill with Tessl

tessl review fix ./.agents/skills/update-deps/SKILL.md
SKILL.md
Quality
Evals
Security

Quality

Content

62%

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

Highly actionable with executable commands and a complete sub-agent workflow, but it could tighten its prose, add post-bump validation checkpoints, and split the large prompt template/schemas into reference files.

Suggestions

Add an explicit post-bump verification checkpoint in Phase 3 — e.g. run `bun install` / the test suite and only log 'bumped' entries once the install and tests pass.

Move the full sub-agent prompt template and the supply-chain-notes JSON schema into referenced files (e.g. references/audit-prompt.md, references/notes-schema.json) and summarize them in SKILL.md.

Trim explanatory prose such as the tier-classification rationale and the 'This is the core of the process' framing where the steps already speak for themselves.

DimensionReasoningScore

Conciseness

The body is mostly efficient with concrete commands and a tight JSON schema, but the sub-agent prompt template and tier table add length beyond what Claude strictly needs, and there is some hand-holding prose.

2 / 3

Actionability

Provides fully executable commands (`bun outdated`, `npm view`, `npm diff`, `bun update pkg@version`), a complete copy-paste-ready sub-agent prompt, and a concrete JSON logging schema with field definitions.

3 / 3

Workflow Clarity

Phases are clearly sequenced and there is a failure-handling note ('mark that package as defer'), but the execution phase lacks an explicit validate-then-proceed checkpoint — there is no verification that bumps succeeded or that the lockfile/tests still pass after the batch update.

2 / 3

Progressive Disclosure

Content is well-organized into phases but everything is inline in a single SKILL.md with no bundle files; the large sub-agent template and JSON schemas could be split into references for easier navigation.

2 / 3

Total

9

/

12

Passed

Description

65%

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

The description is specific and distinctive with a clear niche, but lacks an explicit 'Use when...' trigger clause and could cover more natural user phrasings for triggering.

Suggestions

Add an explicit 'Use when ...' clause naming natural triggers like 'when the user asks to update, bump, or upgrade dependencies' or 'when checking for outdated npm/Bun packages'.

Include everyday terms a user would actually say (e.g. 'bump deps', 'outdated packages', 'upgrade dependencies') to broaden trigger coverage.

DimensionReasoningScore

Specificity

Lists several concrete actions — 'verifies maintainers, publish age, tarball diffs, and provenance before bumping' and 'defers risky packages' — rather than vague language.

3 / 3

Completeness

Clearly states what the skill does, but there is no explicit 'Use when...' trigger clause, so the 'when' guidance is only implied — this caps completeness at 2 per the rubric.

2 / 3

Trigger Term Quality

Includes relevant terms like 'npm/Bun dependencies', 'supply chain integrity', and 'bumping', but omits common natural phrasings a user would say such as 'update outdated packages', 'bump deps', or 'check for dependency updates'.

2 / 3

Distinctiveness Conflict Risk

The supply-chain-integrity + maintainer/tarball/provenance niche is specific and unlikely to overlap with generic package-management or build skills.

3 / 3

Total

10

/

12

Passed

Validation

100%

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation16 / 16 Passed

Validation for skill structure

No warnings or errors.

Repository
backnotprop/plannotator
Reviewed

Table of Contents

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.