菜单
Use this skill when auditing dependency versions, checking for outdated packages, or scanning for security vulnerabilities across the project's repos. Don't use it for upgrading packages (that requires a separate implementation task) or for deployment config template issues (use deployment).
默认使用会先检查来源的 Prompt；你也可以切换为直接命令，或下载本地副本。
决定是否安装前，请先阅读 SKILL.md，以及 SkillsMP 当前展示的配套文件。
用 Codex 或 Claude 帮你安装 复制这段 Prompt，粘贴到 Codex、Claude 或其他助手里，让它检查 Skill 页面并帮你完成安装。
直接命令不会经过审查 Prompt；运行前请先检查来源。
npx skills add https://github.com/atretyak1985/swarmery --skill deps-check命令会保持在同一行。复制前请横向滚动并检查完整内容。
想先保存到本地？可下载 SkillsMP 当前能够提供的文件。
正在显示 SKILL.md
| name | deps-check |
| version | 1.0.0 |
| owner | swarmery-core |
| description | Use this skill when auditing dependency versions, checking for outdated packages, or scanning for security vulnerabilities across the project's repos. Don't use it for upgrading packages (that requires a separate implementation task) or for deployment config template issues (use deployment). |
| allowed-tools | Read, Bash, Glob, Grep |
| disable-model-invocation | true |
| color | teal |
| docs | {"status":"reviewed","source_sha":"e6895cc4f08f","updated":"2026-08-06T00:00:00.000Z"} |
Audit dependency versions across all of the project's repositories (see .claude/project.json → repos), producing a structured report of outdated packages, security vulnerabilities, and cross-repo version mismatches. This skill scans and reports only; it does not modify lockfiles or upgrade packages. For acting on findings, hand off to the implementation agent with the report as input.
Placeholders: <mainApp> = project.json → mainApp; <device> = project.json → device (the device/edge repo, if the project has one); <infrastructure-repo> = the project's infrastructure/chart repo(s).
npm update / pip install --upgrade (that is an implementation task, not an audit)deployment)package-lock.json or requirements.txt) -- flag as incomplete scan rather than proceedingpackage.json for a new feature (not a full audit)npm (v9+), pip / pip-audit, helm (v3+), network access to package registries.claude/project.json → repos -- typically:
apps/<mainApp> (Node.js)<device> (Python)repos: string[] -- List of repos to scan. Defaults to all repos from .project.json → reposseverity_threshold: "critical" | "high" | "moderate" | "low" -- Minimum severity to include in report. Default: "moderate"Format: Structured markdown report returned inline to the caller.
Length budget: Max 200 lines per report. Consolidate the outdated-packages table if it exceeds 20 rows (show top 20 by severity, append a "... and N more" note).
Output template:
## Dependency Audit Report
**Date**: {YYYY-MM-DD}
**Repos scanned**: {N} of {total}
**Scan failures**: {list of repos where scan command failed, or "None"}
### Summary
| Repo | Dependency file | Total deps | Outdated | Vulnerable (>= threshold) |
|------|----------------|------------|----------|---------------------------|
| apps/<mainApp> | package.json | {N} | {N} | {N} |
| <device> | requirements.txt | {N} | {N} | {N} |
| <infrastructure-repo> | Chart.yaml (subcharts) | {N} | {N} | N/A |
### Critical / High Vulnerabilities
| Package | Current | Fixed in | Severity | CVE | Repo |
|---------|---------|----------|----------|-----|------|
| {name} | {ver} | {ver} | {sev} | {id} | {repo} |
### Cross-Repo Version Mismatches
| Package | Version in repo A | Version in repo B | Notes |
|---------|-------------------|-------------------|-------|
### Outdated Packages (non-vulnerable)
| Package | Current | Latest | Type | Repo |
|---------|---------|--------|------|------|
### Recommendations
1. {Prioritized action item with specific version target}
Locate dependency files -- For each repo in the input list, find the dependency manifest:
apps/<mainApp>: package.json + package-lock.json<device>: requirements.txt, requirements-dev.txt, and pyproject.toml (if present)charts/*/Chart.yaml (subchart dependencies)Checkpoint: At least one dependency file found per repo. If a repo has no dependency file, log it as a scan gap.
Run outdated checks -- Execute scan commands with error handling. Scans for the Node.js and Python repos are independent -- run them as parallel Bash calls. The chart-repo update must complete before chart searches.
# Node.js (main app) -- can run in parallel with Python scan
cd apps/<mainApp> && npm outdated --json 2>/dev/null || echo '{"error": "npm outdated failed"}'
# Python (device repo) -- can run in parallel with Node scan
cd <device> && pip list --outdated --format=json 2>/dev/null || echo '[]'
# Charts (all chart repos) -- must run after helm repo update
helm repo update 2>/dev/null # Side effect: updates local chart repo cache; requires network
helm search repo <chart-name> --versions
Checkpoint: Each scan command either produced output or an error message was captured.
Run security scans -- Execute vulnerability checks (Node.js and Python scans can run in parallel):
# Node.js
cd apps/<mainApp> && npm audit --json 2>/dev/null
# Python
cd <device> && pip-audit --format=json 2>/dev/null || echo '{"error": "pip-audit not installed or failed"}'
Checkpoint: Security scan output captured for each repo.
Check cross-repo alignment -- Compare shared package versions across repos. For TypeScript packages used in multiple places, verify version consistency.
Checkpoint: Any version mismatches logged.
Compile report -- Assemble findings into the output template above. Sort vulnerabilities by severity (critical first). Include scan failures in the report header. Respect the 200-line length budget.
Checkpoint: Report assembled with all sections populated (or marked "None found").
Triage recommendations -- For each critical/high vulnerability, check if a patched version exists and note the upgrade path. When recommending an upgrade, consult the package CHANGELOG or migration guide for breaking changes between the current and target versions, and include a post-upgrade testing checklist (typecheck, unit tests, build) plus a rough effort estimate. Do NOT run npm audit fix or pip install --upgrade automatically.
Checkpoint: Top 3 recommendations prioritized by severity and fix availability.
helm repo update side effect was explicitly noted (it modifies the local chart repo cache)npm audit fix, npm update, or pip install --upgrade was executed (this skill is read-only)npm audit fix or pip install --upgrade -- this skill audits only; upgrades require a separate taskpip-audit is installed -- check first and report if missinghelm repo update as a side effect -- it mutates the local chart repo cache and requires network accesspyproject.toml -- modern Python projects may declare dependencies there instead of requirements.txtnpm outdated warnings as vulnerabilities -- outdated is not the same as vulnerablenpm audit or pip-audit command is not available and cannot be installed# Step 1: Scan the main app (runs in parallel with Step 2)
cd apps/<mainApp>
npm outdated --json
# {
# "next": {"current": "16.1.6", "wanted": "16.1.8", "latest": "16.2.0"},
# "some-orm": {"current": "0.45.1", "wanted": "0.45.1", "latest": "0.46.0"}
# }
npm audit --json
# {
# "vulnerabilities": {
# "got": {"severity": "moderate", "via": ["CVE-2025-XXXX"], "fixAvailable": true}
# }
# }
# Step 2: Scan the device repo (runs in parallel with Step 1)
cd <device>
pip list --outdated --format=json
# [{"name": "device-protocol-lib", "version": "2.4.41", "latest_version": "2.4.43"}]
pip-audit --format=json
# {"dependencies": [], "vulnerabilities": []}
# Step 3: Scan chart dependencies (after helm repo update)
helm repo update
helm search repo bitnami/postgresql --versions | head -5
Report output:
## Dependency Audit Report
**Date**: 2026-05-24
**Repos scanned**: 3 of 3
**Scan failures**: None
### Summary
| Repo | Dependency file | Total deps | Outdated | Vulnerable (>= moderate) |
|------|----------------|------------|----------|--------------------------|
| apps/<mainApp> | package.json | 42 | 2 | 1 |
| <device> | requirements.txt | 15 | 1 | 0 |
| <infrastructure-repo> | Chart.yaml | 3 | 0 | N/A |
### Critical / High Vulnerabilities
None at this severity level.
### Outdated Packages (non-vulnerable)
| Package | Current | Latest | Type | Repo |
|---------|---------|--------|------|------|
| next | 16.1.6 | 16.2.0 | npm | apps/<mainApp> |
| some-orm | 0.45.1 | 0.46.0 | npm | apps/<mainApp> |
| device-protocol-lib | 2.4.41 | 2.4.43 | pip | <device> |
### Recommendations
1. Upgrade `got` in the main app to fix moderate CVE-2025-XXXX (fix available via `npm audit fix`)
2. Evaluate the Next.js minor upgrade for bug fixes (test build + typecheck before merging)
3. Upgrade device-protocol-lib 2.4.41 -> 2.4.43 for protocol updates
npm outdated hangs -- symptom: command does not return within 60 seconds -- detect: timeout on Bash execution -- fix: check network connectivity; run with --json flag for faster outputpip-audit not installed -- symptom: command not found error -- detect: stderr captured -- fix: report as scan gap in the audit report; suggest pip install pip-audithelm repo update fails -- symptom: cannot fetch latest chart versions -- detect: non-zero exit code -- fix: check chart repo configuration (helm repo list) and network accessnpm outdated cannot determine wanted versions -- detect: warning in npm output -- fix: report as scan gap; recommend running npm install to generate lockfilecode-quality -- after deps-check identifies outdated packages, code-quality may review the upgrade PRdeployment -- deps-check should run before deployment to catch vulnerable dependenciesdeployment -- defer deployment config dependency version authoring to deployment; deps-check only reports current stateenv-check -- shares the same repo scope (project.json → repos); align repo lists when auditing both dependencies and env varsThis skill audits the dependency health of every repository in your project and hands you one report. It finds outdated packages, known security vulnerabilities, and cases where two repos pin different versions of the same shared package. It reads and reports only — it never upgrades a package or touches a lockfile.
deployment skill.package.json for a single new feature, not running a full audit.Skill(skill: "core:deps-check")
Invoke it with no arguments to scan every repo listed in .claude/project.json → repos, or name the repos and severity threshold you want in your request.
repos — the list of repos to scan — optional; defaults to all repos from project.json → repos.severity_threshold — the lowest vulnerability severity to include (critical, high, moderate, or low) — optional; defaults to moderate.A markdown report returned inline, capped at 200 lines. It opens with the date, how many repos were scanned, and any scans that failed. Then a per-repo summary table, critical and high vulnerabilities with CVE ids and fixed-in versions, cross-repo version mismatches, remaining outdated packages, and a short prioritized recommendation list. One side effect: helm repo update refreshes your local chart cache.
Skill(skill: "core:deps-check")
> Run the monthly dependency audit across all repos.
The skill locates each manifest, runs the package-manager and vulnerability scans for the Node and Python repos in parallel, then refreshes the chart cache and checks chart versions. You get back a report like: 3 of 3 repos scanned, no scan failures, 42 npm deps in apps/<mainApp> with 2 outdated and 1 moderate CVE, 15 pip deps in <device> with 1 outdated, no critical or high findings, and three ranked recommendations naming the exact target versions.
env-check — same repo scope; use it when the question is about environment variables rather than packages.code-quality — reach for it after this audit, to review the pull request that performs the upgrades.deployment — use it for deployment config and chart authoring; this skill only reports the current state.
基于 SOC 职业分类