菜单
How to audit, update, and manage dependencies. When to update vs. pin. How to evaluate whether an update is safe.
用 Codex 或 Claude 帮你安装 复制这段 Prompt，粘贴到 Codex、Claude 或其他助手里，让它检查 Skill 页面并帮你完成安装。
基于 SOC 职业分类
Complete reference for the factory CLI — all commands, arguments, options, and usage. Use when an agent needs to invoke factory commands, check correct syntax, or understand available options.
When and how to write a human-action-needed entry to memory/{agent}/needs.md. Agents write these entries when they hit blockers that only a human can resolve.
When you encounter a failure, correction, or new pattern, write a learning and optionally propose a skill.
How the factory workspace is organized and what each directory means.
What to examine during a reflection pass and how to write observations to memory/{agent}/needs.md.
When and how to write scenario holdouts for factory verification.
| name | dependency-management |
| description | How to audit, update, and manage dependencies. When to update vs. pin. How to evaluate whether an update is safe. |
On each heartbeat, check for:
pip audit (Python), npm audit (Node), cargo audit (Rust)pip list --outdated, npm outdated, cargo outdatedSecurity advisories with CRITICAL or HIGH severity → immediate update, no deferral. Medium severity → schedule within the current week. Low severity → batch with next planned update cycle.
Update when:
Pin when:
Document the reason for any pin in a comment next to the pinned version.
Before updating a dependency:
An update that breaks tests is not safe — revert and investigate.
When Builder adds a new dependency (via a spec or maintenance task):
source-evaluation skill)pyproject.toml / package.json / Cargo.toml with a version constraint, not unpinned