CtrlK
BlogDocsLog inGet started
Tessl Logo
SkillPublic

dependencies-audit

MUST be used whenever fixing dependency issues in a Flows app. This skill finds AND fixes vulnerabilities, outdated packages, deprecated dependencies, and license issues — it does not just report them. Triggers: dependencies, packages, fix dependencies, update packages, fix vulnerabilities, npm audit fix, pnpm audit fix, CVE fix, outdated, deprecated, supply chain, license.

86

1.88x
Quality

88%

Does it follow best practices?

Impact

79%

1.88x

Average score across 3 eval scenarios

SecuritybySnyk

Low

Low-risk findings worth noting

SKILL.md
Quality
Evals
Security

Quality

Content

77%Weight 40%Scale 1-5

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

The body is highly actionable with an excellently sequenced and validated 8-step workflow. Its weaknesses are redundancy (repeated lookup scripts and verification instructions) and the absence of progressive disclosure — a single monolithic file where the output template and license criteria should be split into reference files.

Suggestions

Factor the repeated `npm view --json` metadata lookup (Steps 2, 5, and 6) into one reusable snippet or script and reference it from each step.

Move the review-packages.md output template and the license acceptability lists into a references/ file and link to them, keeping SKILL.md as an overview.

State the verify step ("pnpm install && pnpm run build") once as a standing rule after fixes instead of repeating it in every step.

DimensionReasoningScore

Conciseness

The ~300-line body is mostly executable commands with no conceptual padding, but it repeats the same `npm view --json` lookup block in Steps 2, 5, and 6, restates "run `pnpm install` and `pnpm run build` to verify" six-plus times, and includes a ~40-line sample output template with fabricated rows — more than the "minor trimming" of anchor 4.

3 / 5

Actionability

Guidance is copy-paste ready throughout: concrete node/bash snippets for lookups and audits, exact health-score criteria in a table, explicit acceptable vs. legal-review license lists, and a fully specified output format for review-packages.md.

5 / 5

Workflow Clarity

Eight clearly sequenced steps with explicit validation checkpoints and feedback loops ("re-run `pnpm audit` to confirm the vulnerabilities are resolved", build-verify after every fix, revert-and-note on breaking major updates), satisfying the validation requirement for batch/destructive operations.

5 / 5

Progressive Disclosure

Sections are clearly organized with no nesting problem, but everything is inlined in one ~300-line file with no bundle references — the output template, license lists, and the repeated lookup scripts clearly belong in separate reference files, matching anchor 3's "content that should be separate is inline".

3 / 5

Total

16

/

20

Passed

Description

96%Weight 40%Scale 1-5

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

A strong description: concrete third-person capability statement, explicit use-when clause with a trigger list, and good natural-language keywords. The only weaknesses are a few missing synonyms in the trigger list and minor overlap risk from broad terms like "packages".

Suggestions

Add missing natural trigger synonyms such as "upgrade packages", "audit dependencies", and "package.json".

Qualify broad trigger terms (e.g., "outdated packages in a Flows app") to reduce overlap with general package-management skills.

DimensionReasoningScore

Specificity

"finds AND fixes vulnerabilities, outdated packages, deprecated dependencies, and license issues — it does not just report them" lists multiple specific concrete actions with comprehensive coverage of the dependency-audit domain, matching the top anchor.

5 / 5

Completeness

It explicitly answers both questions: the what ("finds AND fixes vulnerabilities, outdated packages, deprecated dependencies, and license issues") and the when ("MUST be used whenever fixing dependency issues in a Flows app", reinforced by an explicit Triggers list), matching the anchor-5 pattern.

5 / 5

Trigger Term Quality

"Triggers: dependencies, packages, fix dependencies, update packages, fix vulnerabilities, npm audit fix, pnpm audit fix, CVE fix, outdated, deprecated, supply chain, license" gives good natural-term coverage including tool commands, but misses common synonyms like "upgrade packages", "audit dependencies", or "package.json" that would make it fully comprehensive.

4 / 5

Distinctiveness Conflict Risk

The "Flows app" scope plus npm/pnpm audit and CVE triggers give it a distinct niche, but generic terms like "dependencies, packages, outdated, license" create minor overlap risk with general package-management skills.

4 / 5

Total

18

/

20

Passed

Validation

87%

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 14 / 16 Passed

Validation for skill structure

CriteriaDescriptionResult

allowed_tools_field

'allowed-tools' contains unusual tool name(s)

Warning

metadata_version

'metadata.version' is missing

Warning

Total

14

/

16

Passed

Repository

cognitedata/builder-skills

Path

skills/dependencies-audit/SKILL.md

Reviewed

Table of Contents

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.