Run any Skill in Manus with one click

review-dependencies

Stars0

Forks0

UpdatedJuly 14, 2026 at 11:10

Analyze project dependencies for security vulnerabilities, license compliance, and staleness. Use when auditing dependencies, checking for CVEs, reviewing license obligations, or assessing upgrade risk. Not for actually upgrading packages (use update:deps instead).

Installation

Install with Codex or Claude Copy this prompt, paste it into Codex, Claude, or another assistant, and let it review the skill page and install it for you.

Run Skill in Manus

Source

rhuss

rhuss/cc-skill

View GitHub Repository View Creator Repositories

Download

Run Skill in Manus

Related occupationsSOC

Based on SOC occupation classification

Software DevelopersComputer and Mathematical Occupations·SOC 15-1252

SKILL.md

readonly

name	review:dependencies
description	Analyze project dependencies for security vulnerabilities, license compliance, and staleness. Use when auditing dependencies, checking for CVEs, reviewing license obligations, or assessing upgrade risk. Not for actually upgrading packages (use update:deps instead).
allowed-tools	["Read","Bash","Glob"]
user-invocable	true

Dependency Review

Perform a read-only analysis of the project's dependency tree. This skill reads lock files, queries vulnerability databases, and produces a structured report. It does not modify any files.

Procedure

Step 1: Identify Package Manager

Detect which package manager the project uses by checking for lock files:

package-lock.json or yarn.lock or pnpm-lock.yaml -> Node.js
Cargo.lock -> Rust
go.sum -> Go
requirements.txt or poetry.lock or uv.lock -> Python

If multiple lock files exist, analyze all of them and report separately.

Step 2: Scan for Vulnerabilities

For each detected ecosystem, run the appropriate audit command:

Node.js: npm audit --json or yarn audit --json
Rust: cargo audit --json
Go: govulncheck ./...
Python: pip-audit --format json

Parse the JSON output and extract: package name, installed version, vulnerability ID (CVE), severity, and fixed version (if available).

Step 3: Check License Compliance

Read the lock file to extract all transitive dependencies and their licenses. Flag any dependency using:

GPL-3.0 (copyleft, may conflict with proprietary code)
AGPL-3.0 (network copyleft)
Unknown or missing license

Step 4: Assess Staleness

For each direct dependency, compare the installed version against the latest available:

Current: installed version matches latest
Minor behind: patch or minor version available
Major behind: major version available (breaking changes likely)
Abandoned: no release in over 2 years

Step 5: Generate Report

Output a markdown table with columns:

Sort by severity: vulnerabilities first, then license issues, then staleness.

More from this repository

same repository

skill-enhance

rhuss/cc-skill

Improve a SKILL.md file by applying missing or weak skill-authoring patterns (17 patterns across 7 categories). Use when a skill needs strengthening, after running skill:check to identify gaps, or when creating a new skill from scratch. Do NOT use for prompt-level improvements (use prompt:enhance instead) or for evaluation only (use skill:check instead).

2026-07-150

skill-measure

rhuss/cc-skill

Run a baseline-enhance-reeval loop on a SKILL.md to measure improvement. Generates targeted test cases for enhanced patterns to ensure the comparison reflects actual improvement in changed areas. Use when testing whether skill:enhance actually improves eval scores, measuring skill quality before and after changes, or automating the measure-enhance-measure workflow. Do NOT use for evaluation only (use /eval-run instead), for enhancement only (use skill:enhance instead), or for setting up eval infrastructure (use /eval-analyze and /eval-dataset instead).

2026-07-150

skill-check

rhuss/cc-skill

Evaluate a SKILL.md file using three-layer linting: schema validation, 17 skill-authoring patterns, and optional substance review (--deep). Use when reviewing skill quality, checking pattern coverage, testing activation metadata, or assessing a skill before sharing. Add --deep for qualitative substance review. Do NOT use for prompt-level analysis (use prompt:skill-checker instead) or for enhancing/rewriting skills (use skill:enhance instead).

2026-07-150

deploy-staging

rhuss/cc-skill

Deploy a service to the staging environment with health checks and rollback. Use when asked to deploy, push to staging, release to staging, or test a deployment. Do NOT use for production deployments (use deploy:production instead) or for CI/CD pipeline configuration.

2026-07-140

format-code

rhuss/cc-skill

Format source code files

2026-07-140

db-migrate

rhuss/cc-skill

Run database migrations against the target environment. Use when applying schema changes, running pending migrations, or checking migration status. Do NOT use for seed data insertion or database backups.

2026-07-140

name	review:dependencies
description	Analyze project dependencies for security vulnerabilities, license compliance, and staleness. Use when auditing dependencies, checking for CVEs, reviewing license obligations, or assessing upgrade risk. Not for actually upgrading packages (use update:deps instead).
allowed-tools	["Read","Bash","Glob"]
user-invocable	true

Dependency Review

Perform a read-only analysis of the project's dependency tree. This skill reads lock files, queries vulnerability databases, and produces a structured report. It does not modify any files.

Procedure

Step 1: Identify Package Manager

Detect which package manager the project uses by checking for lock files:

package-lock.json or yarn.lock or pnpm-lock.yaml -> Node.js
Cargo.lock -> Rust
go.sum -> Go
requirements.txt or poetry.lock or uv.lock -> Python

If multiple lock files exist, analyze all of them and report separately.

Step 2: Scan for Vulnerabilities

For each detected ecosystem, run the appropriate audit command:

Node.js: npm audit --json or yarn audit --json
Rust: cargo audit --json
Go: govulncheck ./...
Python: pip-audit --format json

Parse the JSON output and extract: package name, installed version, vulnerability ID (CVE), severity, and fixed version (if available).

Step 3: Check License Compliance

Read the lock file to extract all transitive dependencies and their licenses. Flag any dependency using:

GPL-3.0 (copyleft, may conflict with proprietary code)
AGPL-3.0 (network copyleft)
Unknown or missing license

Step 4: Assess Staleness

For each direct dependency, compare the installed version against the latest available:

Current: installed version matches latest
Minor behind: patch or minor version available
Major behind: major version available (breaking changes likely)
Abandoned: no release in over 2 years

Step 5: Generate Report

Output a markdown table with columns:

Sort by severity: vulnerabilities first, then license issues, then staleness.