dep-check

Name: dep-check
Availability: InStock
Author: mikecubed

Audit dependency manifests for vulnerabilities, lag, and misclassifications.

Updated Mar 18, 2026

Search Tags:#dependencies #audit #vulnerabilities #package.json #ci-cd #pyproject #go.mod

Ready to run

npx skills add https://github.com/mikecubed/agent-orchestration --skill dep-check-mikecubed

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: dep-check
Source: https://github.com/mikecubed/agent-orchestration/tree/main/plugins/ccc/skills/dep-check
Command: npx skills add https://github.com/mikecubed/agent-orchestration --skill dep-check-mikecubed

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes scripts (resource) components.

What problem does it solve?

Enforces dependency health rules (DEP-1 through DEP-5) and automates vulnerability scanning for production dependencies, helping teams prevent insecure or outdated packages. It is loaded by the conductor for dependency update operations and CI full-check runs, and it invokes scripts/dep_audit.sh for automated vulnerability scanning.

Core Features & Use Cases

Detect known vulnerabilities and outdated dependencies in production manifests (e.g., package.json, go.mod, pyproject.toml).
Flag lagging dependencies and misclassified dev/prod dependencies.
Identify unused or extraneous dependencies and help prepare remediation or migration.
Activated by commands like "check dependencies", "update deps", "CVE", or "npm audit".

Quick Start

Use the dep-check skill to audit production dependencies and surface actionable remediation guidance.

Frequently Asked Questions about dep-check

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I audit package dependencies for vulnerabilities in a CI pipeline?▼

Auditing dependencies for vulnerabilities in CI involves running scripts/dep_audit.sh to parse manifests like package.json, go.mod, and pyproject.toml, producing actionable citations for insecure or outdated packages.

What types of dependency health problems can automated scanning detect?▼

Automated dependency scanning detects known vulnerabilities, version lag, unused or extraneous packages, dev/prod misclassifications, and unpinned production versions across npm, yarn, poetry, and go module systems.

Does dependency vulnerability scanning work with both go.mod and pyproject.toml files?▼

Yes, dependency vulnerability scanning works with go.mod and pyproject.toml files, alongside npm and yarn manifests, parsing them to enforce dependency health rules and flag insecure production packages.

How do I identify unused or misclassified dev dependencies in my project?▼

To identify unused or misclassified dev dependencies, the audit parses your manifest files to flag extraneous packages and incorrect dev/prod classifications, helping you prepare remediation or migration.

What is the best way to enforce unpinned production dependency versions locally?▼

The best way to enforce unpinned production dependency versions locally is running dep_audit.sh, which enforces health rules DEP-1 through DEP-5 to prevent version lag and secure production manifests.