Loading skill
Install any skill in seconds. Free to start, no credit card required.
Get Started Free →Dependency management specialist. Use when updating dependencies, scanning for vulnerabilities, analyzing dependency trees, or ensuring license compliance. Handles npm, pip, maven, and other package managers.
.claude/skills/aiskillstore-dependency-management/SKILL.md| Test case | Without → With | Effect | Δ tokens | Δ turns |
|---|---|---|---|---|
| case-10 | ✗→✓ | ▲ Improved | -19% | 0% |
| case-11 | ✗→✓ | ▲ Improved | -43% | 0% |
| case-04 | ✓→✓ | ＝ Same ✓ | 174% | 0% |
| case-05 | ✓→✓ | ＝ Same ✓ | 152% | 0% |
| case-06 | ✓→✓ | ＝ Same ✓ | 79% | 0% |
This skill manages project dependencies including updates, vulnerability scanning, license compliance, and dependency tree optimization.
This skill includes Python helper scripts in scripts/:
parse_dependencies.py: Parses dependency files (package.json, requirements.txt, pyproject.toml). Outputs JSON with parsed dependencies and metadata.bash python scripts/parse_dependencies.py package.json requirements.txt
Update all dependencies and check for vulnerabilitiesScan dependencies for security issuesCheck license compatibility for all dependenciesUsing Helper Script:
The skill includes a Python helper script for parsing dependency files:
bash# Parse dependency files python scripts/parse_dependencies.py package.json requirements.txt pyproject.toml
Package Manager Tools:
npm outdated, npm listpip list --outdatedmvn versions:display-dependency-updatesgradle dependencyUpdatesTools:
npm auditpip-auditProcess:
Safe Update Process:
Input: Scan for vulnerabilities
Output:
markdown## Dependency Vulnerability Scan ### Critical Vulnerabilities **1. lodash (4.17.20)** - **Severity**: High - **Issue**: Prototype Pollution - **Fix**: Update to 4.17.21
npm update lodash
**2. express (4.16.4)**
- **Severity**: Medium
- **Issue**: Path Traversal
- **Fix**: Update to 4.18.2
npm update express
### Summary
- **Total vulnerabilities**: 5
- **Critical**: 1
- **High**: 2
- **Medium**: 2
For package manager-specific commands and patterns, load reference files as needed:
references/package_managers.md - Commands and patterns for npm, pip, Poetry, Maven, Gradle, Cargo, and common dependency management patternsreferences/DEPENDENCY_AUDIT.template.md - Dependency audit report template with vulnerabilities, outdated packages, license complianceWhen working with specific package managers, load references/package_managers.md and refer to the relevant package manager section.
| Case | Status | Duration (ms) | Turns | Tokens | Tool calls | ||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Without | With | Δ | Without | With | Δ | Without | With | Δ | Without | With | Δ | ||
case-01 | fail→fail | 10,546 | 16,629 | +58% | 1 | 1 | 0% | 1,921 | 1,174 | -39% | 0 | 0 | — |
case-02 | fail→fail | 10,674 | 6,222 | -42% | 1 | 1 | 0% | 1,855 | 1,244 | -33% | 0 | 0 | — |
case-03 | fail→fail | 6,978 | 3,940 | -44% | 1 | 1 | 0% | 1,277 | 1,262 | -1% | 0 | 0 | — |
case-04 | pass→pass | 3,034 | 2,956 | -3% | 1 | 1 | 0% | 454 | 1,243 | +174% | 0 | 0 | — |
case-05 | pass→pass | 3,652 | 3,199 | -12% | 1 | 1 | 0% | 539 | 1,357 | +152% | 0 | 0 | — |
case-06 | pass→pass | 9,103 | 3,714 | -59% | 1 | 1 | 0% | 779 | 1,396 | +79% | 0 | 0 | — |
case-07 | pass→pass | 5,218 | 2,866 | -45% | 1 | 1 | 0% | 645 | 1,267 | +96% | 0 | 0 | — |
case-08 | pass→pass | 8,597 | 2,131 | -75% | 1 | 1 | 0% | 1,322 | 1,242 | -6% | 0 | 0 | — |
case-09 | pass→pass | 4,515 | 2,300 | -49% | 1 | 1 | 0% | 693 | 1,211 | +75% | 0 | 0 | — |
case-10 | fail→pass | 8,750 | 1,461 | -83% | 1 | 1 | 0% | 1,370 | 1,104 | -19% | 0 | 0 | — |
case-11 | fail→pass | 12,528 | 1,620 | -87% | 1 | 1 | 0% | 1,897 | 1,074 | -43% | 0 | 0 | — |
case-12 | pass→pass | 13,548 | 4,520 | -67% | 1 | 1 | 0% | 2,153 | 1,608 | -25% | 0 | 0 | — |
case-13 | pass→pass | 12,680 | 5,668 | -55% | 1 | 1 | 0% | 2,002 | 1,815 | -9% | 0 | 0 | — |
case-14 | pass→pass | 3,040 | 2,342 | -23% | 1 | 1 | 0% | 422 | 1,193 | +183% | 0 | 0 | — |
case-15 | pass→pass | 10,753 | 9,677 | -10% | 1 | 1 | 0% | 1,706 | 2,660 | +56% | 0 | 0 | — |
case-16 | pass→pass | 9,531 | 8,318 | -13% | 1 | 1 | 0% | 1,559 | 2,151 | +38% | 0 | 0 | — |
case-17 | pass→pass | 11,031 | 3,390 | -69% | 1 | 1 | 0% | 1,764 | 1,375 | -22% | 0 | 0 | — |
case-18 | pass→pass | 7,387 | 2,149 | -71% | 1 | 1 | 0% | 1,083 | 1,253 | +16% | 0 | 0 | — |
case-19 | pass→pass | 8,210 | 2,529 | -69% | 1 | 1 | 0% | 1,278 | 1,320 | +3% | 0 | 0 | — |
case-20 | pass→pass | 9,090 | 11,244 | +24% | 1 | 1 | 0% | 1,621 | 2,828 | +74% | 0 | 0 | — |
case-21 | pass→pass | 4,848 | 4,700 | -3% | 1 | 1 | 0% | 965 | 1,801 | +87% | 0 | 0 | — |
case-22 | pass→pass | 11,320 | 8,916 | -21% | 1 | 1 | 0% | 2,166 | 2,561 | +18% | 0 | 0 | — |
DecimalAI ran this skill against gemini-3.6-flash twice over the same eval suite — once with the skill loaded and once without — and compared the two runs case by case. 22 cases were attempted, and 20 counted toward the lift figure. The other 2 produced results that are not comparable between the two arms, so they are excluded from the headline rather than averaged into it. The headline lift of +9 percentage points is the difference between those two pass rates over the 20 comparable cases. 1 case got worse with the skill loaded, and it is included in that figure.
Without the skill loaded, the model failed this case. With it loaded, the same prompt on the same model passed. This is one improved case from the latest verified run; every case, including any that regressed, is in the table above.
Other measured skills in the registry, with their headline benchmark lift.