codebase-cleanup-deps-audit

You are a dependency security expert specializing in vulnerability scanning, license compliance, and supply chain security. Analyze project dependencies for known vulnerabilities, licensing issues, outdated packages, and provide actionable remediation strategies.

Quality

47%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

Securityby

Low

Low-risk findings worth noting

Fix and improve this skill with Tessl

tessl review fix ./skills/codebase-cleanup-deps-audit/SKILL.md

Quality

Content

35%

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

The body is well-structured into clear sections but the Instructions are abstract with no executable tooling or commands, and the only external reference points to a file not present in the bundle. Adding concrete commands and either creating or removing the dangling reference would substantially improve it.

Suggestions

Replace abstract instruction verbs with concrete, executable commands and tools, e.g. "Run `npm audit --json` / `pip-audit` / `osv-scanner -L lockfile`" and a license scan such as `syft`, so guidance is copy-paste ready.

Add an explicit validation feedback loop to the workflow, e.g. after proposing upgrades re-run the vulnerability scan to confirm CVEs are resolved and run tests to verify compatibility.

Either create `resources/implementation-playbook.md` or remove both references to it; currently Claude is directed to a file that does not exist in the bundle.

Drop the verbatim restatement of the description and the redundant "Context" paragraph to tighten token efficiency.

Dimension	Reasoning	Score
Conciseness	The body is mostly lean bullet points and short sections, but it repeats the frontmatter description verbatim at the top and the "Context" section restates the skill's purpose, so it sits at "mostly efficient but could be tightened" rather than fully lean.	2 / 3
Actionability	Instructions are abstract directions ("Run vulnerability and license scans", "Propose upgrades with compatibility notes") with no concrete commands, tool names, or code — it describes rather than instructs, matching the vague anchor and falling below score 2 which requires at least some concrete detail.	1 / 3
Workflow Clarity	A clear sequence exists (inventory → scan → prioritize → propose) with a staging verification note under Safety, but the core workflow lacks explicit validation feedback loops such as re-scanning after an upgrade, so it is sequence-present-but-checkpoints-implicit rather than score 3.	2 / 3
Progressive Disclosure	Sections are well-organized and the reference to `resources/implementation-playbook.md` is one level deep and clearly signaled, but that file does not exist in the bundle (no references/scripts/assets/resources directories), so navigation leads to a dead end rather than clean one-level-deep references.	2 / 3
	Total	7 / 12 Passed

Description

60%

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

The description clearly communicates capabilities with concrete actions but omits an explicit "Use when..." trigger clause, leaving the "when to use it" half only implied. Adding natural trigger phrases would lift completeness, trigger-term quality, and distinctiveness together.

Suggestions

Append an explicit "Use when..." clause with natural user phrasings, e.g. "Use when auditing dependencies for vulnerabilities (npm audit, pip-audit, osv-scanner), checking license compliance, or planning package upgrades."

Add common trigger variations users actually say (e.g., "dependency vulnerabilities", "CVE", "supply-chain risks", "outdated packages") to broaden natural keyword coverage.

Tighten the framing from a generic "security expert" toward the dependency-specific niche to reduce overlap with broader security skills.

Dimension	Reasoning	Score
Specificity	Lists multiple concrete actions — "vulnerability scanning, license compliance, and supply chain security" plus "Analyze project dependencies for known vulnerabilities, licensing issues, outdated packages, and provide actionable remediation strategies" — matching the multiple-specific-actions anchor rather than the score-2 single-domain anchor.	3 / 3
Completeness	The "what" is clearly and comprehensively answered, but there is no "Use when..." clause or equivalent explicit trigger guidance, so per the rubric guideline completeness is capped at 2 rather than reaching 3.	2 / 3
Trigger Term Quality	Relevant domain terms like "vulnerabilities", "license compliance", and "outdated packages" appear, but coverage of natural user phrasings is thin and leans technical, so it sits at "some relevant keywords but missing common variations" rather than full coverage.	2 / 3
Distinctiveness Conflict Risk	The dependency-audit niche is identifiable but the broad "security expert" framing and absence of distinct explicit triggers mean it could overlap with general security skills, placing it at "somewhat specific but could still overlap" rather than a clear distinct niche.	2 / 3
	Total	9 / 12 Passed

Validation

100%

Warnings & errors only

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 16 / 16 Passed

Validation for skill structure

No warnings or errors.

Repository: rmyndharis/antigravity-skills
Path: skills/codebase-cleanup-deps-audit/SKILL.md
Commit: e63f7dd

Reviewed: about 5 hours ago

Table of Contents

Discovery Implementation Validation

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.