Ready to supercharge your AI agents?

Install any skill in seconds. Free to start, no credit card required.

Get Started Free →

Dependency Analysis Patterns · vibeeval | DecimalAI

Dependency Analysis Patterns

SkillScore23Maintained

dependency-analysis-patterns

Dependency graph visualization, circular dependency detection, CVE scanning, and license compliance

Code Reviewby vibeeval

Links this skill to your agents and keeps it current with the author’s updates.

Automatic

Coding pack

1 · One-time — install the CLI (docs ↗)

pip install decimalai

2 · Get the skill — writes .claude/skills/dependency-analysis-patterns/SKILL.md

decimalai skills pull dependency-analysis-patterns --out .claude/skills/

No CLI? Get the same file — curl · raw file

curl -fsSL --create-dirs -o .claude/skills/dependency-analysis-patterns/SKILL.md https://app.decimal.ai/s/dependency-analysis-patterns/SKILL.md

Raw file: /s/dependency-analysis-patterns/SKILL.md ↗ · machine-readable summary at /s/dependency-analysis-patterns.json ↗

In productionGlobal

how this skill behaves on real traffic · last 30 days

No production data for this skill yet — usage numbers appear here once agents start running it.

Anonymized aggregate across every org using this skill — proof from real production use, not a demo.

Does this skill help? · Benchmark: with vs. withoutsign in to run this on your agents

22 test cases from the publisher’s eval.yaml · each run twice on gemini-3.6-flash — with the skill injected, then without · last run 54d ago

Yes — +18% lift · at higher cost+27% tokens0% turns23% of whole cases pass with skill (5/22)

Test case	Without → With	Effect	Δ tokens	Δ turns
case-03	✗→✓	▲ Improved	—	—
case-07	✗→✓	▲ Improved	—	—
case-01	✗→✓	▲ Improved	—	—
case-13	✗→✓	▲ Improved	—	—
case-15	✓→✓	＝ Same ✓	—	—

Showing 5 of 22 cases

SkillSafety

✓ 3 of 3 passed

Code scan15 of 15 checks clean

0 critical · 0 warning · 0 info — scanner v4 — 7/30/2026

live_secretremote_code_executionreverse_shelldata_exfiltrationssrf_metadataagent_snoopinganti_refusaldestructive_commandsobfuscated_unicodeunicode_homoglyphopaque_blobsuspicious_urltool_overreachtrigger_abuseprompt_injection_phrasing

IntentSafe

LLM judge · does the skill do what it claims

ContentClean

LLM judge · policy & harmful-content review

Source

Imported

vibeeval / vibecosystem

skills/dependency-analysis-patterns/SKILL.md

View on GitHub ↗

License MITImported 8/1/2026Version v1

Skill contents

SKILL.md

Dependency Analysis Patterns

Dependency Graph Visualization

bash
# npm
npx depcruise --output-type dot src/ | dot -T svg > deps.svg

# Python
pipdeptree --graph-output svg > deps.svg

# Go
go mod graph | modgraphviz | dot -T svg > deps.svg

Circular Dependency Detection

bash
# JavaScript/TypeScript
npx madge --circular src/
npx dpdm --circular src/index.ts

# Python
pydeps --cluster --no-show src/

Fix Strategies

| Circular Tip | Çözüm | |-------------|-------| | A → B → A | Interface/port ile inversion | | A → B → C → A | Shared module extract et | | Barrel file circular | Direct import kullan |

CVE Scanning

bash
# npm
npm audit --json | jq '.vulnerabilities | to_entries[] | select(.value.severity == "critical")'

# pip
pip-audit --format json --desc

# Go
govulncheck ./...

# Multi-tool
trivy fs --severity CRITICAL,HIGH .

CVE Prioritization

| CVSS | Severity | Aksiyon | SLA | |------|----------|---------|-----| | 9.0+ | Critical | Hotfix | 24h | | 7.0-8.9 | High | Sprint fix | 1 hafta | | 4.0-6.9 | Medium | Backlog | 1 ay | | <4.0 | Low | Track | Fırsatçı |

License Compliance

bash
# npm
npx license-checker --production --json --failOn "GPL-3.0;AGPL-3.0"

# Python
pip-licenses --format=json --fail-on="GPL-3.0"

| License | Commercial OK | Copyleft | Risk | |---------|-------------|----------|------| | MIT | Evet | Hayır | Düşük | | Apache-2.0 | Evet | Hayır | Düşük | | BSD-3 | Evet | Hayır | Düşük | | MPL-2.0 | Evet | Kısmi | Orta | | LGPL | Dikkat | Kısmi | Orta | | GPL-3.0 | Dikkat | Evet | Yüksek | | AGPL-3.0 | Dikkat | Evet | Çok yüksek |

Update Impact Analysis

bash
# npm - outdated
npm outdated --json

# Semver risk
# patch (0.0.x) → güvenli
# minor (0.x.0) → genelde güvenli
# major (x.0.0) → breaking change riski

# Test after update
npm update <pkg> && npm test

Checklist

] npm audit / pip-audit temiz (critical/high yok)
] License audit pass (GPL yok)
] Circular dependency yok
] Lockfile committed ve güncel
] Unused dependency yok (depcheck)
] Renovate/Dependabot aktif
] Major version behind ≤1

Anti-Patterns

Audit warning'leri ignore etmek
Lockfile commit etmemek
Pinned version kullanmamak (^, ~)
License check'siz production dependency
Dependency update'siz 6+ ay

Illustrative Want to see what dependency-analysis-patterns would put in front of your model? Preview the rendered body and check its trigger phrases — no LLM call, no signup.

Latest benchmark · publisher runVerified

7/30/2026, 09:22 UTC · 22 cases

Lift

+18%

23% vs 5%

Agent turns

0%

1.0 vs 1.0

Tokens

+27%

2,146.68 vs 1,693.91

fail → pass · 4pass → pass · 1fail → fail · 17

Per-case results (22)

Case	Status	Duration (ms)			Turns			Tokens			Tool calls
Case	Status	Without	With	Δ	Without	With	Δ	Without	With	Δ	Without	With	Δ
case-20 We want to configure our `package.json` manifest so that our Node.js library exports both CommonJS (`require`) and ES Module (`import`) entry points. What standard package manifest field handles this conditional module resolution in Node.js?	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-18 What tool should be run during periodic dependency maintenance to identify unreferenced or orphan packages in a Node.js repository?	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-21 When installing dependencies for a Python application in a production container from a `requirements.txt` file, what standard `pip` command installs the exact packages listed without attempting to upgrade them?	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-15 How are LGPL and MPL-2.0 open-source licenses classified regarding commercial use compatibility and risk level?	pass→pass	—	—	—	—	—	—	—	—	—	—	—	—
case-16 When planning package updates, how should semantic versioning increments (patch, minor, major) be assessed for breaking change risk?	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-19 What package versioning practices in manifest files are considered anti-patterns when maintaining predictable production builds?	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-06 Our TypeScript frontend application in 'src/' seems to have circular import references causing runtime initialization bugs. What CLI tool specifically checks for circular dependencies across TypeScript files?	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-17 After updating a package in a Node.js project, what immediate verification command sequence ensures the update did not break the build?	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-10 We want to run an automated check on npm dependencies that inspects JSON audit output and isolates only critical severity security issues using command-line filters. How should this command be structured?	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-03 We want to generate a vector SVG diagram of our JavaScript project's internal module dependency graph located in 'src/'. What command line pipeline converts the module imports into a DOT formatted graph and renders it as an SVG image?	fail→pass	—	—	—	—	—	—	—	—	—	—	—	—
case-14 How can a Python project automatically verify installed dependency licenses via CLI and trigger a failure if any GPL-3.0 licensed packages are detected?	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-07 What command-line tool analyzes a Python source directory like 'src/' for circular module imports without launching a GUI viewer?	fail→pass	—	—	—	—	—	—	—	—	—	—	—	—
case-08 We discovered a direct circular dependency where Module A imports Module B and Module B imports Module A. What design pattern refactoring resolves this two-module coupling?	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-01 We need to set up vulnerability scanning for our Python application's third-party packages. Please provide the command-line approach for auditing Python dependencies along with a standard SLA framework for prioritizing and fixing CVEs based on severity.	fail→pass	—	—	—	—	—	—	—	—	—	—	—	—
case-02 Before releasing our Node.js product, we need to ensure our installed packages don't introduce restrictive open-source licenses. Could you give me the command to automate license compliance checks on production packages and explain how to evaluate license risk levels for commercial software?	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-04 Our Python backend needs a visual dependency tree exported as an SVG file to document our architecture. What CLI tool outputs this graph directly to SVG format?	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-05 How do we render an SVG visual map of a Go module's dependency graph using standard command-line tools?	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-09 In our frontend code, importing components from index barrel files causes circular import errors. What is the recommended strategy to fix barrel file circularity?	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-11 How should a Go project perform static analysis for known security vulnerabilities in its dependencies via command line?	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-12 We need a universal filesystem security scanner that can scan the local directory for both CRITICAL and HIGH severity package vulnerabilities across mixed language stacks. What tool command accomplishes this?	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-13 If a dependency vulnerability has a CVSS score between 7.0 and 8.9 (High severity), what is the standard fix action and maximum remediation timeframe?	fail→pass	—	—	—	—	—	—	—	—	—	—	—	—
case-22 We want our Go project builds in CI to use local copies of third-party dependencies stored directly inside our repository rather than downloading modules over the network. What standard Go command creates and populates this local dependency folder?	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—

These cases were also screened by the skill’s intent / safety pass.See the Trust review ↗Reproduce this benchmark in Colab ↗

How this skill was measured

DecimalAI ran this skill against gemini-3.6-flash twice over the same eval suite — once with the skill loaded and once without — and compared the two runs case by case. 22 cases were attempted. The headline lift of +18 percentage points is the difference between those two pass rates over the 22 comparable cases.

Model measured: gemini-3.6-flash
Graded by: gemini-3.6-flash
Grading method: judged
Verification: verified
Pass rate without the skill: 4.6%
Pass rate with the skill: 22.7%
Cases attempted: 22
Cases counted toward lift: 22
Cases that regressed: 0
Skill version measured: v1
Run completed: 7/30/2026, 09:22 UTC

The per-case answers from this run were removed by the retention sweep, so the case table below shows the verdicts without the text either arm produced. The counts above were recorded at the time and are unaffected. Answers are now kept for 180 days.

SkillScore blends 4 signals1 of 4 complete

BenchmarkPass rate WITH skill on a verified run23

Live evalNeeds ≥10 evaluated traces in 30 days

AI ratingNeeds ≥10 rated traces

AdoptionNeeds ≥10 serves across ≥2 orgs in 30 days

Efficiency · separate axis (at equal correctness)+0% turns+7% tokens

Shown for transparency; not credited unless a verified run shows no correctness regression.

Backed by 1 of 4 signals — each added signal makes the score more robust.

Verified on gemini-3.6-flash · re-tested 53 days ago

Other measured skills in the registry, with their headline benchmark lift.