agentsclimarketplace

Dependency management

Skill bg-szy/TOP-SKILLS/skills/marketplace/dependency-management

全球最大的 Claude Code 技能聚合库 · 收录 3900+ 来自 12+ 来源的技能，提供在线搜索与趋势分析看板 / The world's largest Claude Code skill aggregation hub — 3900+ skills from 12+ sources with online search and trend dashboard

Install
npx -y skills add bg-szy/TOP-SKILLS --skill dependency-management

Assembled from the repository path, not quoted from the project. Check it against their README if it does not work.

2 things to look at

  • no licenseNo license file was found in the repository. Code published without one is not open source by default, so using it at work is a question for whoever answers licensing questions where you are.
  • 4 stars4 stars. Stars are a popularity signal and not a quality one, but at this level it is likely that nobody has read this closely except its author, and you would be relying on your own review.

What its author says it does

Copied from the file, not written here

Dependency management specialist. Use when updating dependencies, scanning for vulnerabilities, analyzing dependency trees, or ensuring license compliance. Handles npm, pip, maven, and other package managers.

SKILL.md

4.2 KB, as published. Nobody here has run it

Dependency Management

This skill manages project dependencies including updates, vulnerability scanning, license compliance, and dependency tree optimization.

When to Use This Skill

  • When updating project dependencies
  • When scanning for security vulnerabilities
  • When analyzing dependency trees
  • When ensuring license compliance
  • When resolving version conflicts
  • When optimizing dependency usage

What This Skill Does

  1. Dependency Analysis: Identifies unused dependencies and version conflicts
  2. Vulnerability Scanning: Finds and fixes known security vulnerabilities
  3. License Compliance: Verifies dependency licenses are compatible
  4. Safe Updates: Updates dependencies with testing and validation
  5. Tree Optimization: Optimizes dependency trees and reduces bloat
  6. Version Management: Resolves version conflicts and updates

Helper Scripts

This skill includes Python helper scripts in scripts/:

  • parse_dependencies.py: Parses dependency files (package.json, requirements.txt, pyproject.toml). Outputs JSON with parsed dependencies and metadata.

    python scripts/parse_dependencies.py package.json requirements.txt

How to Use

Manage Dependencies

Update all dependencies and check for vulnerabilities

Scan dependencies for security issues

Specific Tasks

Check license compatibility for all dependencies

Management Process

1. Analyze Dependencies

Using Helper Script:

The skill includes a Python helper script for parsing dependency files:

# Parse dependency files
python scripts/parse_dependencies.py package.json requirements.txt pyproject.toml

Package Manager Tools:

  • npm: npm outdated, npm list
  • pip: pip list --outdated
  • maven: mvn versions:display-dependency-updates
  • gradle: gradle dependencyUpdates

2. Scan for Vulnerabilities

Tools:

  • npm: npm audit
  • pip: pip-audit
  • maven: OWASP Dependency Check
  • gradle: Dependency Check plugin

3. Check Licenses

Process:

  • List all dependency licenses
  • Check compatibility with project license
  • Identify any incompatible licenses
  • Provide license report

4. Update Dependencies

Safe Update Process:

  1. Check for updates
  2. Review changelogs
  3. Update incrementally
  4. Run tests after each update
  5. Verify functionality

Examples

Example 1: Vulnerability Scan

Input: Scan for vulnerabilities

Output:

## Dependency Vulnerability Scan

### Critical Vulnerabilities

**1. lodash (4.17.20)**
- **Severity**: High
- **Issue**: Prototype Pollution
- **Fix**: Update to 4.17.21
```bash
npm update lodash

2. express (4.16.4)

  • Severity: Medium
  • Issue: Path Traversal
  • Fix: Update to 4.18.2
npm update express

Summary

  • Total vulnerabilities: 5
  • Critical: 1
  • High: 2
  • Medium: 2

## Reference Files

For package manager-specific commands and patterns, load reference files as needed:

- **`references/package_managers.md`** - Commands and patterns for npm, pip, Poetry, Maven, Gradle, Cargo, and common dependency management patterns
- **`references/DEPENDENCY_AUDIT.template.md`** - Dependency audit report template with vulnerabilities, outdated packages, license compliance

When working with specific package managers, load `references/package_managers.md` and refer to the relevant package manager section.

## Best Practices

### Dependency Management

1. **Regular Updates**: Update dependencies regularly
2. **Security First**: Prioritize security updates
3. **Test After Updates**: Always test after updating
4. **Lock Files**: Use lock files (package-lock.json, yarn.lock)
5. **Version Pinning**: Pin critical dependencies

## Related Use Cases

- Dependency updates
- Security vulnerability scanning
- License compliance
- Dependency tree optimization
- Version conflict resolution

Keep looking

Skills are one crate of 328,083. Ordering is by how many stacks a row turns up in, so the top of any crate is what has actually been picked rather than what has the most stars.