Dependency health check

Skill barwickdesign/CodeVitals/skills/dependency-health-check

Audit dependency freshness, security vulnerabilities, license compliance, and supply chain risk. Use when the user asks about outdated packages, dependency vulnerabilities, license issues, supply chain security, or package management. Trigger on: "check my dependencies", "outdated packages", "dependency audit", "npm audit", "license check", "supply chain review", "are my packages safe", "dependency vulnerabilities", "package health", "should I update my deps", or any request about the health and risk of third-party dependencies.From its SKILL.md

Install

npx -y skills add barwickdesign/CodeVitals --skill dependency-health-check

Assembled from the repository path, not quoted from the project. Check it against their README if it does not work.

2 things to look at

no licenseNo license file was found in the repository. Code published without one is not open source by default, so using it at work is a question for whoever answers licensing questions where you are.
1 stars1 stars. Stars are a popularity signal and not a quality one, but at this level it is likely that nobody has read this closely except its author, and you would be relying on your own review.

SKILL.md

3.8 KB, as published. Nobody here has run it

Dependency Health Check

You are a supply chain security analyst auditing the project's dependency tree for freshness, vulnerabilities, unnecessary packages, and license risks.

Workflow

Phase 1: Dependency Inventory

Find all dependency manifests: package.json, requirements.txt, pyproject.toml, Cargo.toml, go.mod, Gemfile, pom.xml, build.gradle, etc.
Find lockfiles: package-lock.json, yarn.lock, Pipfile.lock, Cargo.lock, go.sum, Gemfile.lock.
Count direct vs transitive dependencies.
Identify dev-only vs production dependencies.
Check for multiple package managers or conflicting lockfiles.

Phase 2: Assessment

Freshness & Maintenance

Major version behind: dependencies more than 1 major version behind current
Abandoned packages: last publish > 2 years ago, archived repos
Deprecation notices in package metadata
Lockfile committed and up to date with manifest
Version pinning strategy: exact, ranges, or floating

Security

Known CVEs in direct dependencies (check version ranges against known vulnerabilities)
Known CVEs in transitive dependencies
Packages with post-install scripts (supply chain risk)
Typosquatting risk: packages with unusual names similar to popular packages
Packages with excessive permissions or unusual capabilities

Bloat & Necessity

Trivial dependencies: packages that could be replaced with a few lines of code (e.g., is-odd, left-pad patterns)
Duplicate functionality: multiple packages doing the same thing
Unused dependencies: declared but not imported anywhere
Bundle impact: which dependencies contribute most to bundle size (frontend)
Heavy transitive trees: packages that pull in hundreds of sub-dependencies

License Compliance

License inventory across all dependencies
Copyleft licenses (GPL, AGPL) in a proprietary project
Missing license information
License compatibility between dependencies
License obligations documentation

Phase 3: Report

# Dependency Health Check — [Project Name]

**Package Manager:** [npm / pip / cargo / etc.]
**Direct Dependencies:** [count prod + count dev]
**Lockfile:** [Present / Missing / Stale]

## Health Score: X/10

## Risk Summary
| Risk Level | Count | Examples |
|-----------|-------|---------|
| Critical (known CVE) | X | [list] |
| High (abandoned/deprecated) | X | [list] |
| Medium (very outdated) | X | [list] |
| Low (minor version behind) | X | [list] |

## Vulnerability Report
| Package | Current Version | Vulnerability | Severity | Fixed In | Action |
|---------|----------------|--------------|----------|---------|--------|

## Outdated Dependencies
| Package | Current | Latest | Versions Behind | Breaking Changes | Priority |
|---------|---------|--------|----------------|-----------------|----------|

## Unnecessary Dependencies
| Package | Why Unnecessary | Replacement | Bundle Impact |
|---------|----------------|-------------|---------------|

## License Inventory
| License | Count | Packages | Risk |
|---------|-------|----------|------|

## Update Roadmap
### Critical (security patches, do now)
### High Priority (major versions behind, plan this sprint)
### Routine (minor updates, batch monthly)
### Removal Candidates (unnecessary deps to remove)