dependency-management-deps-audit

You are a dependency security expert specializing in vulnerability scanning, license compliance, and supply chain security. Analyze project dependencies for known vulnerabilities, licensing issues, outdated packages, and provide actionable remediation strategies.

Quality

58%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

Securityby

Low

Low-risk findings worth noting

Fix and improve this skill with Tessl

tessl review fix ./skills/dependency-management-deps-audit/SKILL.md

Quality

Content

42%Weight 40%Scale 1-5

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

The body is reasonably structured and brief, but guidance stays abstract without concrete tooling, and the single external reference it points to is missing from the bundle. Tightening the redundancy and grounding instructions in specific commands would lift the weaker dimensions.

Suggestions

Name concrete tooling and commands (e.g. osv-scanner, npm audit, pip-audit, syft) for the scan and inventory steps so guidance is executable inline.

Add an explicit validate-fix-retry loop for scan output (run scan → triage findings → re-scan after upgrade) since this is a batch operation.

Either create the referenced 'resources/implementation-playbook.md' or remove/correct the reference so progressive disclosure navigation is not broken.

Drop the verbatim re-statement of the description in the opening paragraph and fold the overlapping 'Context' paragraph into the instructions to remove redundancy.

Dimension	Reasoning	Score
Conciseness	The body is mostly tight bullet lists, but it repeats the frontmatter description verbatim in the opening paragraph and the 'Context' section restates the same scope, which could be trimmed.	3 / 5
Actionability	Instructions are high-level directives ('Run vulnerability and license scans', 'Propose upgrades with compatibility notes') with no concrete tools, commands, or examples named, leaving the specific execution steps to an external playbook.	2 / 5
Workflow Clarity	A rough sequence is present (inventory → scan → prioritize → propose), but for a batch dependency operation the only validation is a staging check before production rollout; there is no validate-fix-retry feedback loop around the scan results, which caps this at 3.	3 / 5
Progressive Disclosure	Sections are well organized and a one-level reference is signaled, but the referenced file 'resources/implementation-playbook.md' does not exist in the bundle, making the navigation path broken.	3 / 5
	Total	11 / 20 Passed

Description

75%Weight 40%Scale 1-5

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

The description is specific and distinct with good keyword coverage, but it omits any explicit 'Use when...' trigger guidance, capping its completeness. Adding a concrete when-to-use clause would round it out.

Suggestions

Append an explicit 'Use when...' clause naming natural trigger phrases (e.g. auditing dependencies, checking for CVEs, license compliance, supply-chain risks).

Include ecosystem-specific keywords users actually say (npm audit, pip-audit, package.json, requirements.txt, lockfile) to broaden trigger coverage.

Dimension	Reasoning	Score
Specificity	Lists multiple concrete actions across the domain — 'vulnerability scanning, license compliance, and supply chain security' plus 'known vulnerabilities, licensing issues, outdated packages, and ... remediation strategies' — giving comprehensive coverage with no real gaps.	5 / 5
Completeness	The 'what' is clearly stated, but there is no 'Use when...' clause or equivalent explicit trigger guidance, which per the rubric caps completeness at 3.	3 / 5
Trigger Term Quality	Natural terms like 'vulnerabilities', 'licensing issues', and 'outdated packages' are present, but it lacks common synonyms and ecosystem-specific triggers users would say (e.g. CVE, npm audit, package.json, requirements.txt).	4 / 5
Distinctiveness Conflict Risk	'Dependency security expert specializing in vulnerability scanning, license compliance, and supply chain security' carves out a clear niche with distinct triggers and minimal overlap with other skills.	5 / 5
	Total	17 / 20 Passed

Validation

100%

Warnings & errors only

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 16 / 16 Passed

Validation for skill structure

No warnings or errors.

Repository: rmyndharis/antigravity-skills
Path: skills/dependency-management-deps-audit/SKILL.md
Commit: 3eff4af

Reviewed: 1 day ago

Table of Contents

Discovery Implementation Validation

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.