| name | deps-check |
| version | 1.0.0 |
| owner | swarmery-core |
| description | Use this skill when auditing dependency versions, checking for outdated packages, or scanning for security vulnerabilities across the project's repos. Don't use it for upgrading packages (that requires a separate implementation task) or for deployment config template issues (use deployment). |
| allowed-tools | Read, Bash, Glob, Grep |
| disable-model-invocation | true |
| color | teal |
| docs | {"status":"reviewed","source_sha":"e6895cc4f08f","updated":"2026-08-06T00:00:00.000Z"} |
Purpose
Audit dependency versions across all of the project's repositories (see .claude/project.json → repos), producing a structured report of outdated packages, security vulnerabilities, and cross-repo version mismatches. This skill scans and reports only; it does not modify lockfiles or upgrade packages. For acting on findings, hand off to the implementation agent with the report as input.
Placeholders: <mainApp> = project.json → mainApp; <device> = project.json → device (the device/edge repo, if the project has one); <infrastructure-repo> = the project's infrastructure/chart repo(s).
When to use this skill
- Trigger A -- Periodic dependency audit requested (e.g., monthly security review)
- Trigger B -- Pre-release check to verify no known vulnerabilities ship
- Trigger C -- Cross-repo version alignment check (e.g., ensuring shared TypeScript packages use the same version in the main app)
- Trigger D -- After a CVE advisory, checking if the project's repos are affected
When NOT to use this skill
- Anti-trigger A -- Upgrading packages or running
npm update / pip install --upgrade (that is an implementation task, not an audit)
- Anti-trigger B -- Deployment config template lint errors (use
deployment)
- Anti-trigger C -- Offline environment without network access (package registry queries will fail silently)
- Anti-trigger D -- Repos without a lockfile (
package-lock.json or requirements.txt) -- flag as incomplete scan rather than proceeding
- Anti-trigger E -- Reviewing a single
package.json for a new feature (not a full audit)
Required environment (Runtime: .claude/skills/deps-check/SKILL.md)
- Tools/libraries:
npm (v9+), pip / pip-audit, helm (v3+), network access to package registries
- Allowed tools: Read, Bash, Glob, Grep
- Repos in scope: the project's repos, as listed in
.claude/project.json → repos -- typically:
apps/<mainApp> (Node.js)<device> (Python)- the infrastructure/chart repo(s)
Inputs
repos: string[] -- List of repos to scan. Defaults to all repos from .
