CtrlK
BlogDocsLog inGet started
Tessl Logo

dependency-triage

Scan package manifests and lockfiles for outdated packages and known CVEs. Groups updates by risk (patch, minor, major). Use in dependency sweeper loops.

65

Quality

79%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

SecuritybySnyk

Passed

No findings from the security scan

Fix and improve this skill with Tessl

tessl review fix ./starters/dependency-sweeper/.claude/skills/dependency-triage/SKILL.md
SKILL.md
Quality
Evals
Security

Quality

Content

80%Weight 40%Scale 1-5

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

A tight, well-structured classification spec that assumes Claude's competence and gives concrete output and decision guidance. Its chief gap is the absence of validation checkpoints for a batch operation and the lack of any concrete scanning tooling.

Suggestions

Add an explicit verification step before escalating (e.g., re-check the advisory severity and confirm the suggested bump resolves it) to lift workflow clarity above the batch-operation cap.

Name the scanning tools or commands Claude should use to detect outdated packages and CVEs so the core action is executable rather than implied.

Clarify the input/output handoff with the dependency sweeper loop (what state file is read/written, where overrides live) to make the loop integration concrete.

DimensionReasoningScore

Conciseness

Lean and efficient with no padding: it never explains what CVEs, semver, or lockfiles are, and every line (output template, classification rules, escalation triggers) earns its place.

5 / 5

Actionability

Provides a concrete, copy-paste output template and explicit classification/escalation logic, but leaves the actual scanning mechanism (which tool or command finds outdated packages and CVEs) unspecified, leaving a minor gap.

4 / 5

Workflow Clarity

An implied scan->classify->output->escalate sequence exists, but this batch operation has no validation or verification checkpoints, so workflow clarity is capped at 3 per the batch-operation rule.

3 / 5

Progressive Disclosure

Under 50 lines, single-purpose, and organized into clear sections (Output, Classification Rules, Rules) with no need for external references, matching the simple-skill exception for a 5.

5 / 5

Total

17

/

20

Passed

Description

78%Weight 40%Scale 1-5

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

A specific, well-scoped description that clearly conveys what the skill does and carries low conflict risk. Its main weakness is the trigger clause ('Use in dependency sweeper loops'), which is integration-oriented jargon rather than natural user-facing triggers.

Suggestions

Rewrite the trigger as a user-facing 'Use when...' clause, e.g. 'Use when the user asks to update dependencies, fix vulnerabilities, or check for outdated packages.'

Add common synonyms ('dependencies', 'vulnerabilities', 'security advisories') to broaden natural trigger coverage.

Optionally mention the ecosystems in scope (npm, pip, go) to sharpen distinctiveness.

DimensionReasoningScore

Specificity

Names the domain and three concrete actions ('Scan package manifests and lockfiles for outdated packages and known CVEs', 'Groups updates by risk (patch, minor, major)'); above the 1-2-action anchor but not comprehensive enough for a 5.

4 / 5

Completeness

Clearly states what it does and includes a 'Use in dependency sweeper loops' trigger, so both what and when are present; the when is explicit but narrow/internal rather than user-natural, keeping it below 5.

4 / 5

Trigger Term Quality

Includes natural terms a maintainer would say ('outdated packages', 'known CVEs', 'lockfiles') but misses common synonyms like 'dependencies' or 'vulnerabilities', fitting the good-coverage-with-gaps anchor.

4 / 5

Distinctiveness Conflict Risk

Targets a clear niche (dependency triage on manifests/lockfiles/CVEs) with distinct triggers and minimal overlap with other skills.

5 / 5

Total

17

/

20

Passed

Validation

93%

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation15 / 16 Passed

Validation for skill structure

CriteriaDescriptionResult

frontmatter_unknown_keys

Unknown frontmatter key(s) found; consider removing or moving to metadata

Warning

Total

15

/

16

Passed

Repository
cobusgreyling/loop-engineering
Reviewed

Table of Contents

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.