dependency-triage

Scan package manifests and lockfiles for outdated and vulnerable dependencies. Classify by severity and update type.

Quality

66%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

Securityby

Passed

No findings from the security scan

Fix and improve this skill with Tessl

tessl review fix ./starters/dependency-sweeper-opencode/skills/dependency-triage/SKILL.md

Quality

Content

72%Weight 40%Scale 1-5

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

The body is admirably concise and well-structured, but it is stronger as a scan checklist than as an executable workflow: remediation commands and an explicit scan → classify → update → verify sequence with a failure feedback loop are missing. Adding those would lift actionability and workflow clarity.

Suggestions

Add concrete update/remediation commands (e.g. 'npm install <pkg>@<version>' or 'npm audit fix') so the 'auto-fix candidate' classification is actionable.

Lay out an explicit numbered workflow: scan → classify → apply patch/minor → run `npm ci && npm test` → only approve if tests pass, with a feedback loop when tests fail.

Clarify how denylist entries and the 'patch-only in week one' rule gate which updates get applied, so the decision logic is unambiguous.

Dimension	Reasoning	Score
Conciseness	The body is lean and efficient — short bulleted sections, no padding, and no over-explanation of what npm/cargo/pip are; every token earns its place, matching the anchor 5 example.	5 / 5
Actionability	Scan commands are concrete and executable, but the update/remediation half is only described ('auto-fix candidate', 'escalate') with no actual command to apply a fix or pin a version, leaving key execution details missing — anchor 3.	3 / 5
Workflow Clarity	This is a batch/destructive operation and the rubric caps such skills at 3 when validation is implicit or unordered; a verification step (npm ci && npm test) is mentioned but the scan → classify → update → verify sequence is not laid out as an explicit workflow with a feedback loop for test failures.	3 / 5
Progressive Disclosure	Under 50 lines, single-purpose, no external references needed, and well-organized into clear sections (Scan Sources, Classification, Output, Rules), meeting the simple-skill exception for a 5.	5 / 5
	Total	16 / 20 Passed

Description

61%Weight 40%Scale 1-5

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

The description is concise and domain-specific with good trigger keywords, but it omits an explicit 'Use when' clause, which caps completeness and leaves the 'when' weakly implied. Adding a trigger sentence would lift both completeness and distinctiveness.

Suggestions

Append a 'Use when...' clause naming concrete triggers, e.g. 'Use when the user asks about outdated or vulnerable dependencies, package manifests, or lockfiles.'

Add file extensions and synonyms to broaden trigger coverage (e.g. 'package.json, Cargo.lock, requirements.txt; CVEs, upgrades, deps').

Mention the output artifact (prioritized update list) in the description so the 'what' is fully concrete.

Dimension	Reasoning	Score
Specificity	Names the domain (manifests/lockfiles) and two concrete actions (scan for outdated/vulnerable, classify by severity/update type), but coverage is not comprehensive — no mention of producing remediation or prioritized output. It fits anchor 3 rather than 4 because several relevant actions are absent.	3 / 5
Completeness	It clearly states what the skill does but has no 'Use when...' trigger clause, so per the rubric guideline completeness is capped at 3 — anchor 3 ('clear what but when missing').	3 / 5
Trigger Term Quality	Includes natural terms users would say — 'outdated', 'vulnerable dependencies', 'package manifests', 'lockfiles', 'severity' — giving good keyword coverage, but it misses common synonyms ('deps', 'CVE', 'upgrade') and file extensions, so it is not a 5.	4 / 5
Distinctiveness Conflict Risk	'Package manifests and lockfiles for outdated and vulnerable dependencies' carves a distinct niche with minor overlap risk against a generic audit skill; without explicit trigger phrasing it does not reach 5.	4 / 5
	Total	14 / 20 Passed

Validation

93%

Warnings & errors only

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 15 / 16 Passed

Validation for skill structure

Criteria	Description	Result
frontmatter_unknown_keys	Unknown frontmatter key(s) found; consider removing or moving to metadata	Warning

	Total	15 / 16 Passed

Repository: cobusgreyling/loop-engineering
Path: starters/dependency-sweeper-opencode/skills/dependency-triage/SKILL.md
Commit: 804a4e9

Reviewed: about 13 hours ago

Table of Contents

Discovery Implementation Validation

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.