rune-dependency-doctor

Detects outdated packages and vulnerabilities, then generates a prioritized dependency update plan.

1|Updated Mar 22, 2026
One-click install
npx skills add https://github.com/dangvu008/VietTruyen --skill rune-dependency-doctor-dangvu008
Or copy as Structured Prompt for Agent
Please help me install this Agent Skill.
Skill: rune-dependency-doctor
Source: https://github.com/dangvu008/VietTruyen/tree/main/.agents/skills/rune-dependency-doctor
Command: npx skills add https://github.com/dangvu008/VietTruyen --skill rune-dependency-doctor-dangvu008

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve? Projects accumulate outdated and vulnerable dependencies over time, and manually auditing them across different package managers is slow and error-prone. This Skill automates dependency health checks and turns raw audit output into a prioritized, risk-assessed update plan. ## Core Features & Use Cases - Multi-Ecosystem Detection: Automatically detects npm, yarn, pnpm, pip, cargo, or Go from project manifest files and runs the correct outdated and audit commands. - Vulnerability & Outdated Analysis: Parses CVE findings by severity and classifies updates as patch, minor, or major, flagging breaking-change risk for major bumps. - Prioritized Update Plan with Health Score: Produces a CRITICAL-to-MAJOR ordered plan plus a 0-100 dependency health score, and can execute an upgrade campaign one package at a time with test verification and rollback. - Use Case: Before a release, ask for a dependency health check on your Node.js project to get a report of critical CVEs, safe patch updates, and major upgrades requiring migration planning. ## Quick Start Run a dependency health check on this project and give me a prioritized update plan with a health score.

Frequently Asked Questions about rune-dependency-doctor

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I check for outdated and vulnerable npm packages?

Run npm outdated --json to list packages behind their latest versions and npm audit --json to find known vulnerabilities with CVE IDs and severity levels. This Skill automates both commands and compiles the results into a prioritized update plan.

How to prioritize which dependency updates to apply first?

Prioritize by risk: critical and high CVEs first, then moderate/low vulnerabilities, then safe patch updates, minor updates with testing, and major versions last. Major bumps require breaking-change analysis and migration planning before upgrading.

Does dependency auditing work with Python, Rust, and Go projects?

Yes. The Skill detects the package manager from manifest files: pip or uv for Python (requirements.txt, pyproject.toml), cargo for Rust (Cargo.toml), and go for Go modules (go.mod), then runs the matching outdated and audit commands.

What happens if the vulnerability audit tool is not installed?

The audit step is reported as TOOL_MISSING and explicitly logged rather than silently skipped. The rest of the dependency report, including outdated package analysis and the update plan, still completes.

Can major version upgrades be applied automatically?

No. Major version bumps always require user confirmation, a breaking-change summary, and a migration checklist. Only critical, security, patch, and minor upgrades can run in the automated campaign mode, one package at a time with test verification.