codebase-cleanup-deps-audit

You are a dependency security expert specializing in vulnerability scanning, license compliance, and supply chain security. Analyze project dependencies for known vulnerabilities, licensing issues, outdated packages, and provide actionable remediation strategies.

Quality

51%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

Securityby

Low

Low-risk findings worth noting

Fix and improve this skill with Tessl

tessl review fix ./skills/codebase-cleanup-deps-audit/SKILL.md

Quality

Content

35%

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

The skill is well-structured and concise enough, but its instructions are too abstract to be directly actionable, lack validation checkpoints, and rely on a referenced playbook file that does not exist.

Suggestions

Replace abstract instructions with concrete, executable guidance — name specific tools and commands (e.g., 'osv-scanner', 'npm audit --audit-level=moderate', 'pip-audit', 'syft') with example invocations.

Add validation checkpoints to the workflow (e.g., 'Confirm fixes resolve the reported CVE by re-running the scan before recommending production rollout').

Either create 'resources/implementation-playbook.md' or remove the broken references to it in both the 'Instructions' and 'Resources' sections.

Dimension	Reasoning	Score
Conciseness	Sections are mostly lean, but the frontmatter description is repeated verbatim at the top of the body, the 'Context' section restates the goal, and 'resources/implementation-playbook.md' is referenced twice.	2 / 3
Actionability	Instructions are abstract ('Run vulnerability and license scans', 'Propose upgrades with compatibility notes') with no concrete tools, commands, or executable code, describing rather than instructing.	1 / 3
Workflow Clarity	A logical sequence exists (inventory → scan → prioritize → propose) but there are no validation checkpoints or feedback loops, and the referenced playbook file does not exist.	2 / 3
Progressive Disclosure	The body is well organized into clearly labeled sections, but its only external reference ('resources/implementation-playbook.md') points to a file that is not present in the bundle, leaving a broken navigation path.	2 / 3
	Total	7 / 12 Passed

Description

67%

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

The description is specific and occupies a distinct niche, but it lacks an explicit 'Use when...' trigger clause and could include more natural trigger-term variations a user would actually say.

Suggestions

Add an explicit 'Use when...' clause naming trigger phrases (e.g., 'Use when auditing dependencies, checking for CVEs/vulnerabilities, reviewing license compliance, or upgrading outdated packages').

Include more natural trigger terms users would say, such as 'CVE', 'npm audit', 'supply-chain risk', and 'package security'.

Dimension	Reasoning	Score
Specificity	Lists multiple concrete actions: 'vulnerability scanning, license compliance, and supply chain security' plus 'Analyze project dependencies for known vulnerabilities, licensing issues, outdated packages, and provide actionable remediation strategies.'	3 / 3
Completeness	It clearly answers 'what' but has no explicit 'Use when...' trigger clause, capping completeness at 2 per the rubric guideline.	2 / 3
Trigger Term Quality	Relevant terms like 'dependencies', 'vulnerabilities', 'license compliance', and 'outdated packages' appear, but common variations users would say (CVE, npm audit, supply-chain, package security) are missing.	2 / 3
Distinctiveness Conflict Risk	The 'dependency security' / 'supply chain security' niche is distinct and unlikely to trigger for unrelated skills.	3 / 3
	Total	10 / 12 Passed

Validation

93%

Warnings & errors only

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 15 / 16 Passed

Validation for skill structure

Criteria	Description	Result
frontmatter_unknown_keys	Unknown frontmatter key(s) found; consider removing or moving to metadata	Warning

	Total	15 / 16 Passed

Repository: sickn33/antigravity-awesome-skills
Path: skills/codebase-cleanup-deps-audit/SKILL.md
Commit: a3068b7

Reviewed: about 6 hours ago

Table of Contents

Discovery Implementation Validation

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.