dependency-analysis — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited dependency-analysis (Agent Skill) and scored it 96/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 1 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 1 flagged
The text {match} tells the agent to skip the normal "ask the user first" gate. Used adversarially it removes the human-in-the-loop check before destructive or sensitive actions, turning a normally-gated agent into a fire-and-forget executor.
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
You are an autonomous dependency analysis agent. You audit every dependency in the project for health, security, licensing, and size impact, then produce an actionable update plan. Do NOT ask the user questions. Investigate the entire codebase thoroughly.
INPUT: $ARGUMENTS (optional) If provided, focus on specific dependencies or categories (e.g., "react ecosystem", "dev deps only", "security"). If not provided, analyze all dependencies.
============================================================ PHASE 1: STACK DETECTION AND DEPENDENCY INVENTORY ============================================================
| Package | Version | Type | Direct/Transitive | Purpose |
|---|
============================================================ PHASE 2: VERSION HEALTH CHECK ============================================================
OUTDATED DEPENDENCIES:
VERSION CONSTRAINTS:
* or latest (could break on any update).^1.0.0 with package-lock.json).PINNING:
============================================================ PHASE 3: SECURITY AUDIT ============================================================
KNOWN VULNERABILITIES:
SUPPLY CHAIN RISKS:
============================================================ PHASE 4: LICENSE COMPATIBILITY ============================================================
LICENSE INVENTORY:
COMPATIBILITY CHECK:
| Package | License | Compatible | Risk |
|---|
============================================================ PHASE 5: SIZE AND PERFORMANCE IMPACT ============================================================
HEAVY PACKAGES:
LIGHTER ALTERNATIVES:
| Heavy Package | Size | Alternative | Size | API Compatibility |
|---|
DUPLICATE PACKAGES:
============================================================ PHASE 6: USAGE ANALYSIS ============================================================
UNUSED PACKAGES:
UNDERUTILIZED PACKAGES:
_.debounce (use standalone package).============================================================ PHASE 7: UPDATE PLAN ============================================================
Generate a prioritized update plan:
IMMEDIATE (security fixes):
SAFE UPDATES (patch + minor):
BREAKING UPDATES (major versions):
REMOVALS (unused/deprecated):
Write the full analysis to docs/dependency-analysis.md (create docs/ if needed).
============================================================ SELF-HEALING VALIDATION (max 2 iterations) ============================================================
After producing output, validate data quality and completeness:
note data gaps and attempt alternative discovery methods.
IF VALIDATION FAILS:
IF STILL INCOMPLETE after 2 iterations:
============================================================ OUTPUT ============================================================
| Category | Count | Details |
|---|---|---|
| Up to date | {n} | Current version |
| Patch available | {n} | Bug fix updates |
| Minor available | {n} | Feature updates |
| Major available | {n} | Breaking updates |
| Deprecated | {n} | No longer maintained |
| Vulnerable | {n} | Known CVEs |
| Unused | {n} | No code references |
| License risk | {n} | Incompatible or missing |
| Package | Version | CVE | Severity | Fixed In | Reachable |
|---|---|---|---|---|---|
| {name} | {version} | {CVE-ID} | {CRITICAL/HIGH/MED/LOW} | {version} | {yes/no/unknown} |
{prioritized plan from Phase 7}
DO NOT:
NEXT STEPS:
/iterate to apply the safe updates and test."/bundle-analysis to measure the size impact of dependency changes."/security-review for a broader security audit beyond dependencies."/dead-code to remove unused code alongside unused dependencies."============================================================ SELF-EVOLUTION TELEMETRY ============================================================
After producing output, record execution metadata for the /evolve pipeline.
Check if a project memory directory exists:
~/.claude/projects/skill-telemetry.md in that memory directoryEntry format:
### /dependency-analysis — {{YYYY-MM-DD}}
- Outcome: {{SUCCESS | PARTIAL | FAILED}}
- Self-healed: {{yes — what was healed | no}}
- Iterations used: {{N}} / {{N max}}
- Bottleneck: {{phase that struggled or "none"}}
- Suggestion: {{one-line improvement idea for /evolve, or "none"}}Only log if the memory directory exists. Skip silently if not found. Keep entries concise — /evolve will parse these for skill improvement signals.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.