Menu
How to audit, update, and manage dependencies. When to update vs. pin. How to evaluate whether an update is safe.
Install with Codex or Claude Copy this prompt, paste it into Codex, Claude, or another assistant, and let it review the skill page and install it for you.
Based on SOC occupation classification
Complete reference for the factory CLI — all commands, arguments, options, and usage. Use when an agent needs to invoke factory commands, check correct syntax, or understand available options.
When and how to write a human-action-needed entry to memory/{agent}/needs.md. Agents write these entries when they hit blockers that only a human can resolve.
When you encounter a failure, correction, or new pattern, write a learning and optionally propose a skill.
How the factory workspace is organized and what each directory means.
What to examine during a reflection pass and how to write observations to memory/{agent}/needs.md.
When and how to write scenario holdouts for factory verification.
| name | dependency-management |
| description | How to audit, update, and manage dependencies. When to update vs. pin. How to evaluate whether an update is safe. |
On each heartbeat, check for:
pip audit (Python), npm audit (Node), cargo audit (Rust)pip list --outdated, npm outdated, cargo outdatedSecurity advisories with CRITICAL or HIGH severity → immediate update, no deferral. Medium severity → schedule within the current week. Low severity → batch with next planned update cycle.
Update when:
Pin when:
Document the reason for any pin in a comment next to the pinned version.
Before updating a dependency:
An update that breaks tests is not safe — revert and investigate.
When Builder adds a new dependency (via a spec or maintenance task):
source-evaluation skill)pyproject.toml / package.json / Cargo.toml with a version constraint, not unpinned