dependencies-audit

MUST be used whenever fixing dependency issues in a Flows app. This skill finds AND fixes vulnerabilities, outdated packages, deprecated dependencies, and license issues — it does not just report them. Triggers: dependencies, packages, fix dependencies, update packages, fix vulnerabilities, npm audit fix, pnpm audit fix, CVE fix, outdated, deprecated, supply chain, license.

1.88x

Quality

86%

Does it follow best practices?

Impact

79%

1.88x

Average score across 3 eval scenarios

Securityby

Low

Low-risk findings worth noting

Quality

Content

77%Weight 40%Scale 1-5

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

The body is a strong, actionable, well-validated workflow with concrete code at every step. Its weaknesses are repetition of the npm-metadata lookup pattern and a lack of progressive disclosure — all content lives inline in one long file with no reference files.

Suggestions

Extract the repeated `npm view ... --json` lookup into a single script under ./scripts/ and reference it from Steps 2, 5, and 6 to remove duplication and tighten conciseness.

Move the review-packages.md output template (Step 7) into a reference file under ./references/ and link to it, improving progressive disclosure and reducing SKILL.md length.

Consolidate the per-step 'run pnpm install and pnpm run build to verify' reminders into a single stated verification gate referenced once, rather than restating after every fix.

Dimension	Reasoning	Score
Conciseness	Mostly efficient with executable code and tables, but the same `npm view ... --json` node lookup block is duplicated across Steps 2, 5, and 6, and prose like 'This is informational, not blocking' could be trimmed.	3 / 5
Actionability	Fully executable, copy-paste-ready guidance throughout: concrete `node -e` scripts, `npm view`, `pnpm audit --json`, `pnpm update <package>@latest`, `pnpm overrides` JSON, and `npx license-checker` cover the common cases.	5 / 5
Workflow Clarity	A clear 8-step sequence with explicit validation checkpoints ('run pnpm install and pnpm run build to verify nothing breaks', 're-run pnpm audit to confirm') and feedback loops ('If a major update breaks the build, revert that specific update'), plus a health-score table that functions as a checklist.	5 / 5
Progressive Disclosure	Well-labeled step sections give structure, but the ~300-line file is monolithic: the review-packages.md output template (Step 7) and the repeated lookup scripts are inlined rather than split into reference files, and no bundle files exist.	3 / 5
	Total	16 / 20 Passed

Description

95%Weight 40%Scale 1-5

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

The description is excellent: it states what the skill does, when to use it, and a rich set of natural trigger terms in third-person voice. The only minor gap is that supply-chain risk appears in the trigger list but not in the stated action coverage.

Dimension	Reasoning	Score
Specificity	Lists several concrete issue categories acted on — 'finds AND fixes vulnerabilities, outdated packages, deprecated dependencies, and license issues' — but supply-chain risk (named only in the trigger list) is a minor gap in the action coverage, keeping it just below comprehensive.	4 / 5
Completeness	Explicitly answers both what ('finds AND fixes vulnerabilities, outdated packages, deprecated dependencies, and license issues — it does not just report them') and when ('MUST be used whenever fixing dependency issues in a Flows app') with concrete trigger phrases.	5 / 5
Trigger Term Quality	Comprehensive natural-term coverage including synonyms and tool-specific phrases users actually say: 'dependencies, packages, fix dependencies, update packages, fix vulnerabilities, npm audit fix, pnpm audit fix, CVE fix, outdated, deprecated, supply chain, license.'	5 / 5
Distinctiveness Conflict Risk	Clear niche ('fixing dependency issues in a Flows app') with distinct, specialized triggers like 'npm audit fix', 'pnpm audit fix', and 'CVE fix' that minimize overlap with other skills.	5 / 5
	Total	19 / 20 Passed

Validation

87%

Warnings & errors only

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 14 / 16 Passed

Validation for skill structure

Criteria	Description	Result
allowed_tools_field	'allowed-tools' contains unusual tool name(s)	Warning
metadata_version	'metadata.version' is missing	Warning

	Total	14 / 16 Passed

Repository: cognitedata/builder-skills
Path: skills/dependencies-audit/SKILL.md
Commit: c87160a

Reviewed: 5 days ago

Table of Contents

Discovery Implementation Validation

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.