dependency-triage

Scan package manifests and lockfiles for outdated and vulnerable dependencies. Classify by severity and update type.

Quality

66%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

Securityby

Passed

No findings from the security scan

Fix and improve this skill with Tessl

tessl review fix ./starters/dependency-sweeper-opencode/skills/dependency-triage/SKILL.md

Quality

Content

72%Weight 40%Scale 1-3

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

The content is concise and well-organized with concrete scan commands and a verification step, but its handling actions are abstract and the batch-update workflow lacks an explicit sequence with a validate-fix-retry feedback loop. Tightening the classification handling into executable steps and adding a feedback loop would lift actionability and workflow clarity.

Suggestions

Turn classification handling into concrete steps, e.g. for Patch/Minor: 'apply `npm install pkg@latest`, run tests, commit'; for Major/CVE: 'open an issue with severity and rationale'.

Add an explicit scan→classify→update→verify sequence with a validate-fix-retry loop: run `npm ci && npm test`, and if it fails, revert the update and re-classify.

Replace 'Lockfile analysis' with a specific action such as which lockfile to read and what to look for.

Dimension	Reasoning	Score
Conciseness	The body is lean and well-sectioned with no padding or explanation of concepts Claude already knows; every line (scan sources, classification, output, rules) earns its place.	3 / 3
Actionability	Provides concrete runnable commands (`npm outdated`, `cargo audit`, `npm ci && npm test`) but leaves key handling directives abstract ('Patch: auto-fix candidate', 'Major: escalate to human') and 'Lockfile analysis' vague, so guidance is incomplete.	2 / 3
Workflow Clarity	A verification step exists ('Run npm ci && npm test before approving') but the scan→classify→output sequence is implicit and there is no validate→fix→retry feedback loop, which the rubric requires for batch dependency operations, capping this at 2.	2 / 3
Progressive Disclosure	This is a single-purpose skill under 50 lines with no external references and well-organized sections, which meets the rubric's allowance for progressive_disclosure to score 3 on content organization alone.	3 / 3
	Total	10 / 12 Passed

Description

60%Weight 40%Scale 1-3

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

The description conveys concrete capabilities clearly and in proper third-person voice, but omits any explicit 'when to use' trigger guidance and relies on technical phrasing over natural user language. Adding a 'Use when...' clause with common trigger phrases would raise both completeness and trigger-term quality.

Suggestions

Add an explicit 'Use when...' clause naming natural user triggers, e.g. 'Use when the user asks to update or audit dependencies, check for vulnerable packages, or run npm/cargo/pip audits.'

Include common natural phrasings users would say ('update my packages', 'check dependencies for security') alongside the technical terms.

Reinforce the distinct activation context so the skill is unlikely to trigger for general build or CI tasks.

Dimension	Reasoning	Score
Specificity	Enumerates multiple concrete actions — scanning manifests/lockfiles, detecting outdated and vulnerable packages, and classifying by severity and update type — rather than naming only a domain.	3 / 3
Completeness	Clearly states what the skill does but provides no 'Use when...' trigger, so the 'when' guidance is absent rather than explicit; per the rubric, a missing explicit trigger caps completeness at 2.	2 / 3
Trigger Term Quality	Contains relevant terms like 'outdated and vulnerable dependencies' but leans technical ('manifests and lockfiles') and lacks common natural phrasings a user would actually say, such as 'update my packages' or 'check for security issues'.	2 / 3
Distinctiveness Conflict Risk	The dependency-triage niche is reasonably distinct, but without explicit trigger terms the activation context is only weakly distinguished from related maintenance skills.	2 / 3
	Total	9 / 12 Passed

Validation

93%

Warnings & errors only

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 15 / 16 Passed

Validation for skill structure

Criteria	Description	Result
frontmatter_unknown_keys	Unknown frontmatter key(s) found; consider removing or moving to metadata	Warning

	Total	15 / 16 Passed

Repository: cobusgreyling/loop-engineering
Path: starters/dependency-sweeper-opencode/skills/dependency-triage/SKILL.md
Commit: ffa5bf8

Reviewed: 6 days ago

Table of Contents

Discovery Implementation Validation

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.