Deps

/deps

Audit, update, and manage project dependencies safely.

Usage

/deps [action] [package] [--security] [--outdated]

Arguments

• action: audit, update, add, remove, outdated (default: audit)
• package: Specific package name (for add/remove/update)
• --security: Focus on security vulnerabilities only
• --outdated: Show only outdated packages

Instructions

When this skill is invoked:

Agent Behavior

Autonomy:

• Complete dependency operations end-to-end
• Verify changes don't break the build
• Run tests after updates

Safety:

• Never auto-update major versions without confirmation
• Always check for breaking changes
• Create atomic commits for dependency changes

Actions

Audit (/deps audit)

Check for security vulnerabilities and issues:

1. Read prd/00_technology.md for audit commands
2. Run security audit:

   # Commands vary by stack (see prd/00_technology.md)
   {dependency_audit_command}
   

3. Categorize findings by severity
4. Suggest remediations

Outdated (/deps outdated)

List packages with available updates:

1. Check for updates:

   {outdated_command}
   

2. Categorize by update type:

   • Patch updates (safe)
   • Minor updates (usually safe)
   • Major updates (review changelog)

3. Present update plan

Update (/deps update [package])

Update dependencies safely:

1. If specific package:

   {update_package_command} <package>
   

2. If all packages (patch/minor only):

   {update_all_command}
   

3. Verify after update:

   {install_command}
   {test_command}
   {build_command}
   

4. Create commit:

   chore(deps): update <package> to <version>
   

Add (/deps add <package>)

Add new dependency:

1. Check if already installed
2. Verify package legitimacy:
   • Check download stats
   • Check maintenance status
   • Check for known vulnerabilities
3. Install:

   {add_package_command} <package>
   

4. Verify installation:

   {test_command}
   

Remove (/deps remove <package>)

Remove dependency:

1. Check for usages in codebase
2. Warn if package is used
3. Remove:

   {remove_package_command} <package>
   

4. Clean up imports if needed
5. Verify:

   {test_command}
   

Dependency Report Format

## Dependency Audit Report

**Date:** YYYY-MM-DD
**Total packages:** X
**Direct dependencies:** Y
**Vulnerabilities found:** Z

### Security Vulnerabilities

| Severity | Package | Current | Fixed In | CVE |
|----------|---------|---------|----------|-----|
| High | lodash | 4.17.15 | 4.17.21 | CVE-2021-23337 |
| Medium | axios | 0.21.0 | 0.21.1 | CVE-2021-3749 |

### Outdated Packages

| Package | Current | Latest | Type |
|---------|---------|--------|------|
| react | 17.0.2 | 18.2.0 | Major |
| typescript | 4.9.5 | 5.3.2 | Major |
| jest | 29.5.0 | 29.7.0 | Minor |

### Recommendations

1. **Immediate**: Update lodash to fix high severity CVE
2. **Soon**: Update axios for security patch
3. **Plan**: Evaluate React 18 migration

Update Safety Rules

1. Patch updates (1.0.0 → 1.0.1): Auto-update OK
2. Minor updates (1.0.0 → 1.1.0): Auto-update with tests
3. Major updates (1.0.0 → 2.0.0): Review changelog, confirm

Lockfile Handling

• Always commit lockfile changes
• Never manually edit lockfiles
• Regenerate if conflicts occur

Example Output

$ /deps audit --security

Auditing dependencies...

Package manager: npm
Total packages: 245 (42 direct, 203 transitive)

Security Scan Results:

🔴 High Severity (1)
━━━━━━━━━━━━━━━━━━━
lodash@4.17.15
  CVE-2021-23337: Prototype pollution
  Fixed in: 4.17.21
  Recommendation: npm update lodash

🟡 Medium Severity (2)
━━━━━━━━━━━━━━━━━━━━━
axios@0.21.0
  CVE-2021-3749: ReDoS vulnerability
  Fixed in: 0.21.1

minimist@1.2.5
  CVE-2021-44906: Prototype pollution
  Fixed in: 1.2.6

🟢 Low Severity (0)

━━━━━━━━━━━━━━━━━━━━━
Summary: 3 vulnerabilities found
  - 1 high (action required)
  - 2 medium (update soon)

Suggested fix:
npm update lodash axios minimist

Run `/deps update` to apply security patches.