菜单
Scan package manifests and lockfiles for outdated packages and known CVEs. Groups updates by risk (patch, minor, major). Use in dependency sweeper loops.
用 Codex 或 Claude 帮你安装 复制这段 Prompt，粘贴到 Codex、Claude 或其他助手里，让它检查 Skill 页面并帮你完成安装。
基于 SOC 职业分类
| name | dependency-triage |
| description | Scan package manifests and lockfiles for outdated packages and known CVEs. Groups updates by risk (patch, minor, major). Use in dependency sweeper loops. |
| user_invocable | true |
### package-name (ecosystem: npm|pip|go|etc.)
- Current: x.y.z
- Suggested: x.y.z
- Risk: patch | minor | major
- CVE: none | CVE-XXXX (severity)
- Actionable: yes | no (denylist / human gate)
- Suggested loop action: patch-in-worktree | escalate-human | skip
dependency-sweeper-state.md every run.Read loop-constraints.md at the start of every run and enforce every rule. This skill runs BEFORE triage or any action skill. Constraints are binding.
Scan merged PRs and commits since a given reference, extract titles, labels, types, and signals. Produces structured input for release notes drafting.
Classify CI failures — distinguish clear regressions from infra flakes and security-test failures. Produces structured failure reports.
Scan package manifests and lockfiles for outdated and vulnerable dependencies. Classify by severity and update type.
Scan open issues and discussions, deduplicate, prioritize, and propose labels. Provides a clean actionable queue.
Scan recent merges to main for tech debt, TODOs, debug code, and small cleanup opportunities. Produces a prioritized fix list.