CtrlK
BlogDocsLog inGet started
Tessl Logo
SkillPublic

dependency-management

Manage third-party libraries, runtimes, and SaaS dependencies. Use this skill when setting an update cadence, responding to security advisories, dealing with deprecated dependencies, evaluating new dependencies, auditing what's installed, or unblocking a dependency upgrade. Triggers on dependency, package update, security patch, lockfile, deprecated, breaking change, supply chain, dependency audit, npm audit, dependabot, renovate. Also triggers when a build breaks after an update or when an advisory is published for a used package.

Quality

92%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide
SecuritybySnyk

Passed

No findings from the security scan

SKILL.md
Quality
Evals
Security

Quality

Content

88%Weight 40%Scale 1-5

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

A well-structured, actionable policy skill: concrete commands, a clear sequenced workflow with validation checkpoints, and an appropriately split reference for the deepest procedure. Weaknesses are minor: some repeated points and aphoristic padding, and a long body that could offload more detail (e.g., failure patterns or the 5-dimension evaluation) to reference files.

Suggestions

Trim repetition and aphorisms: the build-tool supply-chain point appears in both Category 3 and Failure patterns, and taglines like 'Automation reduces toil. Manual checking doesn't scale.' can be cut without losing guidance.

Consider moving the 5-dimension evaluation framework and/or the failure-pattern catalog into a reference file (like the existing upgrade-checklist.md) to keep SKILL.md a leaner overview.

DimensionReasoningScore

Conciseness

Mostly efficient policy/framework content Claude would not already know, delivered densely with tables and commands. Minor over-explanation that could be trimmed: the supply-chain-attacks-on-build-tools point appears twice (Category 3: "supply chain attacks target build tools" and Failure patterns), and aphorisms like "Every dependency has a cost. Free packages aren't free." add little.

4 / 5

Actionability

Copy-paste-ready commands cover the common package managers ("npm ls --all --json", "npm audit", "pip-audit", "bundle audit", "depcheck"), plus a concrete severity/directness prioritization table and actionable checklists for adding and removing dependencies.

5 / 5

Workflow Clarity

Eight clearly sequenced steps (Inventory → Audit → Prioritize → Test → Plan upgrades → Policy → Automate → Periodic audit) with an explicit validation step ("Run the full test suite... don't merge a known-broken update") and verification checkpoints in the removal checklist ("Verify tests pass", "Verify build size went down").

5 / 5

Progressive Disclosure

Good structure with clear section headers and a well-signaled, verified one-level reference ("references/upgrade-checklist.md ... Step-by-step checklist for performing a major version upgrade"). Not a 5 because the ~320-line body carries the full framework (4 categories, 5 risk dimensions, failure patterns, evaluation/removal checklists) inline rather than splitting detail into additional reference files.

4 / 5

Total

18

/

20

Passed

Description

95%Weight 40%Scale 1-5

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

A strong description: concrete capability enumeration, explicit 'Use this skill when' triggers, comprehensive natural trigger terms including ecosystem tool names, and a clearly distinct niche. Only minor gaps: the generic lead verb 'Manage' and omission of dependency removal from the capability list.

DimensionReasoningScore

Specificity

"Manage third-party libraries, runtimes, and SaaS dependencies" plus "setting an update cadence, responding to security advisories, dealing with deprecated dependencies, evaluating new dependencies, auditing what's installed, or unblocking a dependency upgrade" lists several concrete actions. Not a 5 because the leading verb is generic ("Manage") and coverage has minor gaps (e.g., dependency removal/cleanup is never named).

4 / 5

Completeness

Explicitly answers both: what ("Manage third-party libraries, runtimes, and SaaS dependencies") and when ("Use this skill when setting an update cadence, responding to security advisories...") with concrete trigger phrases, matching the anchor-5 example structure.

5 / 5

Trigger Term Quality

"Triggers on dependency, package update, security patch, lockfile, deprecated, breaking change, supply chain, dependency audit, npm audit, dependabot, renovate" provides comprehensive natural-language coverage including tool names and synonyms, plus situational phrases like "when a build breaks after an update or when an advisory is published for a used package".

5 / 5

Distinctiveness Conflict Risk

Clear niche (third-party package/lockfile/dependency lifecycle) with highly domain-specific triggers (lockfile, npm audit, dependabot, renovate). The security terms ("security advisory", "security patch") are secondary and contextualized to used packages, so conflict risk with a general security skill is minimal.

5 / 5

Total

19

/

20

Passed

Validation

93%

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 15 / 16 Passed

Validation for skill structure

CriteriaDescriptionResult

frontmatter_unknown_keys

Unknown frontmatter key(s) found; consider removing or moving to metadata

Warning

Total

15

/

16

Passed

Repository

rampstackco/claude-skills

Path

skills/dependency-management/SKILL.md

Reviewed

Table of Contents

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.