dependency-triage

Scan package manifests and lockfiles for outdated and vulnerable dependencies.

Updated Jul 5, 2026

Search Tags:#package management #vulnerability assessment #software security #update management #dependency scanning

Ready to run

npx skills add https://github.com/chenxingqiang/loops-automatic-researching --skill dependency-triage-chenxingqiang

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: dependency-triage
Source: https://github.com/chenxingqiang/loops-automatic-researching/tree/main/starters/dependency-sweeper-opencode/skills/dependency-triage
Command: npx skills add https://github.com/chenxingqiang/loops-automatic-researching --skill dependency-triage-chenxingqiang

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes scripts (resource) components.

What problem does it solve?

Dependency Triage Skill automates the process of scanning package manifests and lockfiles for outdated and vulnerable dependencies, saving time and reducing the risk of security issues.

Core Features & Use Cases

Dependency Scanning: Automatically scans package manifests and lockfiles for outdated and vulnerable dependencies.
Classification: Classifies updates by severity and update type (Patch, Minor, Major, CVE).
Update Management: Updates dependency-sweeper-state.md with a prioritized list of updates.
Use Case: Ideal for software development teams looking to maintain a secure codebase by regularly checking for and addressing outdated dependencies.

Quick Start

Run the dependency-triage skill to scan for outdated and vulnerable dependencies in your project.

Frequently Asked Questions about dependency-triage

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I scan package manifests and lockfiles for vulnerable dependencies?▼

To scan package manifests and lockfiles for vulnerable dependencies, this Skill automates the detection of outdated packages and security risks, classifying updates by severity and type to maintain secure software dependencies.

What is the best way to automate dependency updates and vulnerability scanning?▼

The best way to automate dependency updates and vulnerability scanning is using a Skill that evaluates lockfiles, categorizes updates by Patch, Minor, Major, or CVE severity, and outputs a prioritized list to a state file.

How does dependency classification by severity work for package manifests?▼

Dependency classification by severity works by scanning package manifests and lockfiles, evaluating outdated or vulnerable packages, and sorting required updates into categories like Patch, Minor, Major, and CVE for prioritized management.

Can I manage and prioritize software security updates in a state file?▼

Yes, you can manage software security updates in a state file. This Skill generates and updates a state file with a prioritized list of required dependency updates based on lockfile vulnerability assessments.

Does this dependency scanning tool work without external dependencies?▼

Yes, this dependency scanning tool works without external dependencies. It operates independently using internal scripts to evaluate package manifests and lockfiles for outdated and vulnerable software components.

When do I need to run vulnerability assessments on my package lockfiles?▼

You need to run vulnerability assessments on package lockfiles regularly during development to identify outdated dependencies, classify update severities, and prevent security issues from accumulating in your codebase.