CtrlK
BlogDocsLog inGet started
Tessl Logo
SkillPublic

review-dependency-compatibility

Review dependency, lockfile, and bundled-asset changes for compatibility, provenance, advisory relevance, and consistency with the runtime. Use as one lens in a code review run.

Quality

84%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide
SecuritybySnyk

Passed

No findings from the security scan

SKILL.md
Quality
Evals
Security

Quality

Content

86%Weight 40%Scale 1-5

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

A lean, well-structured review-lens skill that respects the token budget and gives a concrete, traceable method with explicit reporting thresholds and exclusions. The only meaningful gap is the absence of concrete verification commands or a worked example (e.g., how to compare an advisory package path against a lockfile entry).

Suggestions

Add one or two concrete verification commands to the Method or Reporting section, such as 'npm ls <package>' to confirm the resolved version, or a short worked example comparing an advisory package path (e.g. 'semver' via 'node-gyp') with the lockfile entry that actually changed.

In Reporting, name at least one specific confirmatory action per category — e.g. which scan command, which focused test invocation — so 'install, scan, route, or focused test' becomes directly executable.

DimensionReasoningScore

Conciseness

Every section (Scope, Method, Threshold, Reporting) earns its place; the body never explains concepts Claude already knows (it assumes familiarity with lockfiles, advisories, and bundles) and contains no padding. This matches the 'lean and efficient; every token earns its place' anchor, with nothing to trim for a 4.

5 / 5

Actionability

As an instruction-only skill, the guidance is concrete and executable: 'Start at the package or workflow file that changed. Follow it to the lockfile entry, generated bundle, require/import site, install command, and route or test that exercises the changed API. For an advisory fix, compare the advisory package path with the installed package path that changed.' It falls short of 5 only because no concrete commands or worked examples are given (e.g., the specific command or lockfile-entry comparison to run).

4 / 5

Workflow Clarity

The Method gives a clear sequence (changed file → lockfile/bundle/usage sites → advisory-vs-installed path comparison) and the Threshold section supplies explicit decision checkpoints ('Report a change when... Do not report...'). Validation is present but named only as categories ('State the install, scan, route, or focused test that would confirm compatibility') rather than explicit verify-and-retry steps, so it fits 'clear sequence with most checkpoints; minor validation gaps'.

4 / 5

Progressive Disclosure

The skill is under 50 lines with no external references needed, and no bundle files exist, so per the simple-skill guideline well-organized sections alone warrant a 5. The four headed sections (Scope, Method, Threshold, Reporting) are clearly delineated and easy to navigate, with no content that belongs in a separate file.

5 / 5

Total

18

/

20

Passed

Description

75%Weight 40%Scale 1-5

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

A focused, well-scoped description that clearly states what the skill does and includes an explicit use clause. Its main weaknesses are the 'when' guidance being posture-style rather than trigger-phrase-based, and missing natural synonyms (package.json, npm audit, CVE, dependabot) in the trigger terms.

Suggestions

Replace or extend 'Use as one lens in a code review run' with concrete trigger phrases, e.g. 'Use when a pull request changes package.json, package-lock.json, generated browser bundles, or dependency-update workflows, or when a security advisory prompts an upgrade.'

Add natural trigger synonyms such as 'npm audit', 'CVE', 'dependabot/Renovate', or 'package upgrade' so the description matches phrasings users actually say.

DimensionReasoningScore

Specificity

Names the domain (dependency, lockfile, bundled-asset changes) and several concrete review actions — compatibility, provenance, advisory relevance, runtime consistency — with only minor gaps in coverage. It lists several specific actions rather than just 1-2, but the actions are aspect labels rather than a fully comprehensive set of concrete capabilities, so it does not reach 5.

4 / 5

Completeness

The 'what' is clear (review dependency, lockfile, and bundled-asset changes for four named properties) and an explicit use clause exists ('Use as one lens in a code review run'). However, the 'when' describes usage posture rather than concrete trigger phrases like 'when a PR updates package.json or a lockfile', matching the anchor where both are present but 'when' could be more explicit.

4 / 5

Trigger Term Quality

Natural keywords users would say are present: 'dependency', 'lockfile', 'advisory', 'compatibility', 'code review'. Common variations and synonyms are missing — 'package.json', 'npm audit', 'CVE', 'upgrade', 'dependabot' — which fits the 'good keyword coverage; a few natural terms missing' anchor rather than comprehensive coverage.

4 / 5

Distinctiveness Conflict Risk

Scoped to a clear niche — dependency/lockfile/bundle review with distinctive terms like 'bundled-asset', 'lockfile', and 'advisory relevance'. Minor overlap risk remains with a generic code-review or security-review skill because 'Use as one lens in a code review run' keeps it adjacent to those broader skills.

4 / 5

Total

16

/

20

Passed

Validation

100%

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 16 / 16 Passed

Validation for skill structure

No warnings or errors.

Repository

guypod/goof-factory

Path

review-lenses/review-dependency-compatibility/SKILL.md

Reviewed

Table of Contents

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.