skills.rest
mikecubed
mikecubedCOMMUNITY
Explore all skills by this author →
GitHub

dep-check

Audit dependency manifests for vulnerabilities, lag, and misclassifications.

Updated Mar 18, 2026
Search Tags:#dependencies#audit#vulnerabilities#package.json#ci-cd#pyproject#go.mod
One-click install
npx skills add https://github.com/mikecubed/agent-orchestration --skill dep-check-mikecubed
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: dep-check
Source: https://github.com/mikecubed/agent-orchestration/tree/main/plugins/ccc/skills/dep-check
Command: npx skills add https://github.com/mikecubed/agent-orchestration --skill dep-check-mikecubed

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes scripts (resource) components.

What problem does it solve?

Enforces dependency health rules (DEP-1 through DEP-5) and automates vulnerability scanning for production dependencies, helping teams prevent insecure or outdated packages. It is loaded by the conductor for dependency update operations and CI full-check runs, and it invokes scripts/dep_audit.sh for automated vulnerability scanning.

Core Features & Use Cases

  • Detect known vulnerabilities and outdated dependencies in production manifests (e.g., package.json, go.mod, pyproject.toml).
  • Flag lagging dependencies and misclassified dev/prod dependencies.
  • Identify unused or extraneous dependencies and help prepare remediation or migration.
  • Activated by commands like "check dependencies", "update deps", "CVE", or "npm audit".

Quick Start

Use the dep-check skill to audit production dependencies and surface actionable remediation guidance.

Frequently Asked Questions about dep-check

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I audit package dependencies for vulnerabilities in a CI pipeline?▼

Auditing dependencies for vulnerabilities in CI involves running scripts/dep_audit.sh to parse manifests like package.json, go.mod, and pyproject.toml, producing actionable citations for insecure or outdated packages.

What types of dependency health problems can automated scanning detect?▼

Automated dependency scanning detects known vulnerabilities, version lag, unused or extraneous packages, dev/prod misclassifications, and unpinned production versions across npm, yarn, poetry, and go module systems.

Does dependency vulnerability scanning work with both go.mod and pyproject.toml files?▼

Yes, dependency vulnerability scanning works with go.mod and pyproject.toml files, alongside npm and yarn manifests, parsing them to enforce dependency health rules and flag insecure production packages.

How do I identify unused or misclassified dev dependencies in my project?▼

To identify unused or misclassified dev dependencies, the audit parses your manifest files to flag extraneous packages and incorrect dev/prod classifications, helping you prepare remediation or migration.

What is the best way to enforce unpinned production dependency versions locally?▼

The best way to enforce unpinned production dependency versions locally is running dep_audit.sh, which enforces health rules DEP-1 through DEP-5 to prevent version lag and secure production manifests.

Related Skills

Explore More Software Engineering Skills→
cdalsoniiicdalsoniii

Dependency Health Check

Analyze manifest files for CVE exposure, version freshness, maintainer risk, and license compatibility.

Community
Advanced
hamzaPixlhamzaPixl
2

dependency-review

Audit project dependencies for vulnerabilities, outdated versions, license conflicts, and unused packages.

Community
Intermediate
Harmeet10000Harmeet10000
7

golang-continuous-integration

Automate Go CI/CD pipelines with GitHub Actions for testing, linting, and releases.

Community
Advanced
fusenginefusengine
1

dependency-audit

Runs native package-manager vulnerability audits across project dependencies and classifies findings by severity.

Community
Intermediate