codebase-cleanup-deps-audit

You are a dependency security expert specializing in vulnerability scanning, license compliance, and supply chain security. Analyze project dependencies for known vulnerabilities, licensing issues, outdated packages, and provide actionable remediation strategies.

Quality

50%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

Securityby

Passed

No findings from the security scan

Fix and improve this skill with Tessl

tessl review fix ./skills/codebase-cleanup-deps-audit/SKILL.md

Quality

Content

42%Weight 40%Scale 1-5

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

The skill body is well-structured with clear use/anti-use sections and a signaled playbook reference, but it suffers from a duplicated intro, abstract instructions with no named tooling, and a broken reference to a missing resource file. Actionability is the weakest dimension.

Suggestions

Replace abstract instructions with concrete commands and tools, e.g. 'Inventory: parse package-lock.json / requirements.txt; Scan: `npm audit --json` or `pip-audit -r requirements.txt`; SBOM: `cyclonedx-py environment`.'

Add an explicit validation/feedback loop for batch scanning, e.g. 'Re-run scans after each upgrade until zero high-severity findings remain; confirm the dependency graph still resolves.'

Either create `resources/implementation-playbook.md` with the detailed tooling/templates or remove the reference; a dangling path blocks navigation.

Dimension	Reasoning	Score
Conciseness	The body is sectioned and mostly efficient, but the opening paragraph repeats the frontmatter description verbatim and the 'Context' section restates the same scope, adding tokens Claude already has.	3 / 5
Actionability	Instructions are high-level hints ('Run vulnerability and license scans', 'Propose upgrades with compatibility notes') with no concrete commands or named tools (e.g. npm audit, pip-audit, osv-scanner, cyclonedx), leaving the specific execution steps missing.	2 / 5
Workflow Clarity	A rough sequence exists (inventory -> scan -> prioritize -> propose) and the Safety section adds a staging-verification checkpoint, but batch scanning lacks explicit validation/feedback loops, so the batch-operation cap keeps this at 3.	3 / 5
Progressive Disclosure	Sections are well-organized and a one-level-deep reference to a playbook is clearly signaled, but the referenced 'resources/implementation-playbook.md' does not exist in any bundle directory, making the navigation unresolvable.	3 / 5
	Total	11 / 20 Passed

Description

58%Weight 40%Scale 1-5

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

The description conveys a clear niche and several concrete capabilities but lacks an explicit 'Use when' trigger clause and natural tooling synonyms, capping completeness and trigger-term quality at the midpoint. It is distinct and reasonably specific but not comprehensive.

Suggestions

Add an explicit trigger clause, e.g. 'Use when auditing dependencies for vulnerabilities, license compliance, or outdated packages, or when preparing a remediation plan.'

Include natural tooling terms users say (CVE, SBOM, npm audit, pip-audit, OSV) to improve trigger-term coverage.

Tighten 'remediation strategies' into concrete actions like 'propose pinned upgrades and patch paths' to push specificity toward 5.

Dimension	Reasoning	Score
Specificity	Lists several concrete actions ('vulnerability scanning, license compliance, and supply chain security', 'known vulnerabilities, licensing issues, outdated packages', 'remediation strategies') with only minor gaps in coverage; not quite the comprehensive multi-action list of a 5.	4 / 5
Completeness	The 'what' is clear (analyze dependencies for vulnerabilities, licensing, outdated packages, remediation) but there is no 'Use when...' trigger clause, so per the rubric guideline completeness is capped at 3.	3 / 5
Trigger Term Quality	Relevant natural keywords are present ('dependencies', 'vulnerabilities', 'license compliance', 'outdated packages') but common variations and tooling synonyms users say (e.g. CVE, SBOM, npm audit, supply-chain) are missing.	3 / 5
Distinctiveness Conflict Risk	The 'dependency security expert ... vulnerability scanning, license compliance, and supply chain security' framing carves a clear niche with mostly distinct triggers and only minor overlap risk with adjacent security skills.	4 / 5
	Total	14 / 20 Passed

Validation

93%

Warnings & errors only

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 15 / 16 Passed

Validation for skill structure

Criteria	Description	Result
frontmatter_unknown_keys	Unknown frontmatter key(s) found; consider removing or moving to metadata	Warning

	Total	15 / 16 Passed

Repository: sickn33/antigravity-awesome-skills
Path: skills/codebase-cleanup-deps-audit/SKILL.md
Commit: 1f67c44

Reviewed: about 22 hours ago

Table of Contents

Discovery Implementation Validation

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.