dependency-triage

Scan package manifests and lockfiles for outdated packages and known CVEs. Groups updates by risk (patch, minor, major). Use in dependency sweeper loops.

Quality

79%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

Securityby

Passed

No findings from the security scan

Fix and improve this skill with Tessl

tessl review fix ./starters/dependency-sweeper/.claude/skills/dependency-triage/SKILL.md

Dependency Triage Skill

Output per package

### package-name (ecosystem: npm|pip|go|etc.)
- Current: x.y.z
- Suggested: x.y.z
- Risk: patch | minor | major
- CVE: none | CVE-XXXX (severity)
- Actionable: yes | no (denylist / human gate)
- Suggested loop action: patch-in-worktree | escalate-human | skip

Classification Rules

patch: semver patch or lockfile-only security fix with no API change
minor: semver minor — cautious, verifier required
major: always escalate-human unless explicitly pre-approved in state
denylist: packages in state denylist → escalate-human, no auto-touch
high-severity CVE: escalate if fix requires major or breaking change

Rules

Prefer the smallest safe bump that resolves the advisory.
Never bundle unrelated package updates in one change.
Record human overrides from dependency-sweeper-state.md every run.
If lockfile conflict or peer dependency warning → escalate-human.

Repository: cobusgreyling/loop-engineering
Path: starters/dependency-sweeper/.claude/skills/dependency-triage/SKILL.md
Commit: 804a4e9

Last updated: about 12 hours ago
First committed: 2 months ago

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.