codebase-cleanup-deps-audit

You are a dependency security expert specializing in vulnerability scanning, license compliance, and supply chain security. Analyze project dependencies for known vulnerabilities, licensing issues, outdated packages, and provide actionable remediation strategies.

Quality

65%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

Securityby

Low

Low-risk findings worth noting

Fix and improve this skill with Tessl

tessl review fix ./skills/codebase-cleanup-deps-audit/SKILL.md

Quality

Content

65%Weight 40%Scale 1-5

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

The body is admirably concise and well-structured, but its instructions stay at an abstract level without concrete tooling, and the referenced resource file does not exist in the bundle. Adding specific commands and shipping the referenced playbook would materially raise actionability, workflow clarity, and progressive disclosure.

Suggestions

Add concrete, executable commands or tools to the Instructions (e.g. `npm audit --audit-level=moderate`, `pip-audit`, `osv-scanner`, `syft`) instead of generic 'run scans'.

Insert an explicit validation/checkpoint step in the workflow (e.g. verify scan results against a baseline, re-scan after upgrades) to satisfy the feedback-loop requirement for batch operations.

Either create resources/implementation-playbook.md so the referenced path resolves, or remove the dangling reference and inline the essential tooling/templates.

Dimension	Reasoning	Score
Conciseness	Lean bullet-list sections with no padding or explanation of concepts Claude already knows; every section earns its place and assumes Claude's competence.	5 / 5
Actionability	Instructions are high-level ('Run vulnerability and license scans', 'Propose upgrades with compatibility notes') with no concrete tools, commands, or code examples (e.g. npm audit, pip-audit, osv-scanner), leaving key execution details missing.	3 / 5
Workflow Clarity	A rough sequence exists (inventory, scan, prioritize, upgrade) but it is a flat list with no explicit validation checkpoints, and the batch-scan nature of the task caps workflow clarity at 3 per the feedback-loop guidance.	3 / 5
Progressive Disclosure	The body signals a one-level-deep reference to resources/implementation-playbook.md, but no bundle directory (references/, scripts/, assets/) exists and the referenced file is not present, so the reference is unsatisfiable.	3 / 5
	Total	14 / 20 Passed

Description

66%Weight 40%Scale 1-5

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

The description conveys a clear, specific capability set in the dependency-security domain, but it omits any explicit 'when to use' trigger guidance and uses second-person voice, which caps completeness and lowers specificity. Adding a 'Use when...' clause and switching to third-person voice would lift it into the top band.

Suggestions

Add an explicit 'Use when...' clause naming concrete triggers (e.g. 'Use when auditing dependencies, checking for vulnerable packages, or reviewing lockfiles').

Switch to third-person voice ('Analyzes project dependencies...') to comply with the rubric's voice requirement and recover the specificity point.

Include natural synonyms and file extensions users say (lockfiles, package.json, npm audit, pip-audit) to broaden trigger-term coverage.

Dimension	Reasoning	Score
Specificity	Names the dependency-security domain and several concrete actions ('vulnerability scanning, license compliance, and supply chain security', 'Analyze project dependencies for known vulnerabilities, licensing issues, outdated packages'), but the second-person voice ('You are a dependency security expert') triggers the mandated one-point specificity penalty from 5.	4 / 5
Completeness	The 'what' is clear and comprehensive, but there is no explicit 'Use when...' trigger clause, which caps completeness at 3 per the judging guidelines.	3 / 5
Trigger Term Quality	Includes relevant terms ('dependencies', 'vulnerabilities', 'outdated packages', 'remediation') but leans on professional jargon and omits natural synonyms and file extensions users say (e.g. 'lockfile', 'package.json', 'npm audit').	4 / 5
Distinctiveness Conflict Risk	Occupies a clear niche (dependency/security audit) with distinct triggers and only minor overlap risk against general security skills.	4 / 5
	Total	15 / 20 Passed

Validation

100%

Warnings & errors only

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 16 / 16 Passed

Validation for skill structure

No warnings or errors.

Repository: rmyndharis/antigravity-skills
Path: skills/codebase-cleanup-deps-audit/SKILL.md
Commit: 3eff4af

Reviewed: 1 day ago

Table of Contents

Discovery Implementation Validation

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.