| name | dep-debt |
| description | Surface dependency debt — outdated packages, abandoned/deprecated libs, unused deps, version drift across manifests. Static analysis only (no package manager calls). Use before upgrades, audits, or when planning tech renewal. |
| allowed-tools | Read, Grep, Glob, Bash |
| user-invocable | true |
Dep Debt
Surface dependency debt and point at the packages most likely to bite.
Philosophy
"Which dependencies will bite us, and when?"
Every dependency is a bet: that it'll keep working, stay maintained, not have vulnerabilities. Old bets decay. Some libs went abandoned years ago; some pinned versions missed a major release; some packages are installed and imported nowhere. Dep-debt is the audit of those bets.
Not a replacement for npm audit / pip-audit. This skill reads manifests statically and spots patterns. For vulnerability scans, use the ecosystem tool — this skill tells you where to look.
Scope
User may specify a directory. Default: project root. For monorepos, scan all manifests found.
Config Integration
Follow references/config-migration.md for preflight.
Read .assistant-config.md for:
- Stack (which manifests are expected)
- Acknowledged Debt (deps acknowledged as pinned-intentionally)
Stack Detection
Glob for all supported manifests (see references/dep-debt-manifests.md). In a monorepo, expect multiple.
Process
1. Understand context
List all manifests found. Read each. Note declared deps, versions, lockfile presence.
2. Scan
- Outdated / pre-1.0 versions: compare declared versions to signals in the reference.
- Abandoned packages: match against the known-deprecated list.
- Unused deps: for each declared dep, Grep the source for
import/require/from X import. If no match, flag as "appears unused; verify build scripts".
- Version drift: in monorepos, compare the same dep across manifests.
3. Group by manifest
Organize findings per manifest file. A monorepo with three packages should produce three location groups, not one flat list.
4. Assess impact
- High: abandoned packages on runtime critical paths, deps with known major security incidents
- Medium: pre-1.0 versions of stable libs, version drift
- Low: dev deps slightly behind, small unused deps
Reference
references/dep-debt-manifests.mdreferences/debt-output-format.mdreferences/config-migration.md
Output format
Follow references/debt-output-format.md exactly.
What Makes This Different From npm outdated
npm outdated lists versions. This skill tells you which version drift actually matters — lodash three minor versions behind is unlikely to bite; request being abandoned for four years is a landmine. Judgment on top of data.
