secure-dependency-health-check

Helps choose secure, healthy open-source packages by evaluating vulnerability status, maintenance health, popularity, community, and security posture. Use this skill when: - Agent needs to import a new dependency - User asks "which package should I use for X?" - User wants to compare packages (A vs B) - User asks "is this package safe?" - User asks for a "secure alternative" to a package - User mentions "dependency health", "package chooser", or "package security"

Quality

89%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

Securityby

Passed

No findings from the security scan

Quality

Content

85%Weight 40%Scale 1-5

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

A well-sequenced, actionable body with explicit validation checkpoints and error-recovery loops. The main weakness is progressive disclosure: a reference bundle file is present but completely unlinked from the body, leaving inlined detail and an orphaned reference.

Suggestions

Link the existing reference from the relevant section, e.g. in Phase 2 add 'See [package-evaluation-criteria.md](references/package-evaluation-criteria.md) for the full per-factor scoring rubric'.

Move the detailed returned-field definitions (overall_rating, security, maintenance, popularity, community) into the reference, keeping only the fields essential for comparison inline in the body.

Trim the Quick Start so it does not restate the Phase 1-4 sequence, or fold it into Phase 1 to reduce redundancy.

Dimension	Reasoning	Score
Conciseness	Mostly lean: it never explains concepts Claude already knows and uses tight phase/field lists, but the Quick Start partially restates the Phase 1-4 sequence and the example comparison/alternative-scenario templates are somewhat long, so minor trimming is possible.	4 / 5
Actionability	Gives the concrete tool name `snyk_package_health_check`, enumerates the exact returned fields and ecosystems, provides explicit disqualifier criteria, and ships a copy-paste-ready comparison table template plus alternative-scenario template covering common cases.	5 / 5
Workflow Clarity	Phases 1-4 give a clear sequence with an explicit Disqualifiers checkpoint before recommendation, error-handling feedback loops ('Retry once; if still no data, fall back to manual research'), and a Phase 4 post-install verification scan — a checklist plus recovery loops for a batch operation.	5 / 5
Progressive Disclosure	The body is well-sectioned, but a bundle file `references/package-evaluation-criteria.md` exists and is never linked or signaled from the body, so detailed field/criteria content that belongs in that reference is inlined and the reference is unreachable via navigation.	3 / 5
	Total	17 / 20 Passed

Description

95%Weight 40%Scale 1-5

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

A strong description: third-person voice, explicit what-and-when structure, and rich natural trigger phrases tied to a distinct package-security niche. The only gap is that the action list focuses on evaluation criteria rather than the full compare-and-recommend workflow.

Dimension	Reasoning	Score
Specificity	Names the domain (open-source packages) and several concrete evaluation actions — 'evaluating vulnerability status, maintenance health, popularity, community, and security posture' — but omits the downstream actions (comparison/recommendation generation) that the body performs, leaving minor coverage gaps.	4 / 5
Completeness	Clearly answers both 'what' ('Helps choose secure, healthy open-source packages by evaluating...') and 'when' via an explicit 'Use this skill when:' block with six concrete trigger clauses.	5 / 5
Trigger Term Quality	Comprehensive natural trigger phrases users would actually say: 'which package should I use for X?', 'is this package safe?', 'secure alternative', 'dependency health', 'package chooser', and 'package security', with synonym coverage.	5 / 5
Distinctiveness Conflict Risk	Occupies a clear niche (secure/healthy package selection backed by Snyk) with distinct triggers like 'is this package safe' and 'secure alternative' that are unlikely to fire for unrelated skills.	5 / 5
	Total	19 / 20 Passed

Validation

100%

Warnings & errors only

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 16 / 16 Passed

Validation for skill structure

No warnings or errors.

Repository: snyk/studio-recipes
Path: command_directives/synchronous_remediation/skills/secure-dependency-health-check/SKILL.md
Commit: 465f842

Reviewed: 15 days ago

Table of Contents

Discovery Implementation Validation

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.