| name | dependency-review |
| description | Audit changed dependencies for security, compatibility, lockfile hygiene, and necessity. Trigger when package manifests or lockfiles change. |
| owner | any |
| trigger | dependency_added |
| version | 2 |
Dependency Review
Use this when package manifests or lockfiles change.
Scope
This skill applies to dependency changes:
package.json, lockfiles, workspace package manifestsCargo.toml, Cargo.lockpyproject.toml, requirements.txtgo.mod, go.sum
If the change is not dependency-related, return SKIPPED: Not a dependency change.
Workflow
- Identify what changed:
added packages, upgraded versions, removed dependencies, or changed dependency sources.
- Check hygiene:
lockfiles updated, dependency source is expected, and the new dependency is actually needed.
- Check risk:
known advisories if repo tooling supports it, obvious license concerns, and major-version compatibility risk.
- Run the repo build/test verification relevant to the changed manifest.
- Report findings by dependency with severity and recommendation.
Useful Commands
Node
npm audit --production
Rust
cargo audit
Python
pip-audit
If the audit tool is unavailable, say so explicitly instead of pretending the audit ran.
Report Format
CLEAN: no dependency issues found- or one entry per issue:
dependency, severity, reason, recommended action
Keep this skill focused on dependencies. Do not turn it into a general implementation or architecture review.
