dependency-review

name	dependency-review
description	Audit changed dependencies for security, compatibility, lockfile hygiene, and necessity. Trigger when package manifests or lockfiles change.
owner	any
trigger	dependency_added
version	2

Dependency Review

Use this when package manifests or lockfiles change.

Scope

This skill applies to dependency changes:

• package.json, lockfiles, workspace package manifests
• Cargo.toml, Cargo.lock
• pyproject.toml, requirements.txt
• go.mod, go.sum

If the change is not dependency-related, return SKIPPED: Not a dependency change.

Workflow

1. Identify what changed: added packages, upgraded versions, removed dependencies, or changed dependency sources.
2. Check hygiene: lockfiles updated, dependency source is expected, and the new dependency is actually needed.
3. Check risk: known advisories if repo tooling supports it, obvious license concerns, and major-version compatibility risk.
4. Run the repo build/test verification relevant to the changed manifest.
5. Report findings by dependency with severity and recommendation.

Useful Commands

Node

npm audit --production

Rust

cargo audit

Python

pip-audit

If the audit tool is unavailable, say so explicitly instead of pretending the audit ran.

Report Format

• CLEAN: no dependency issues found
• or one entry per issue: dependency, severity, reason, recommended action

Keep this skill focused on dependencies. Do not turn it into a general implementation or architecture review.