Dependency Health Check Skill
Assess dependency health across CVE exposure, freshness, maintainer risk, and license compatibility.
Trigger Conditions
- Weekly automated health check cadence
- New dependency added to the project
- User invokes with "dependency health" or "check dependencies"
Input Contract
- Required: Dependency manifest (go.mod, package.json, requirements.txt)
- Optional: CVE database reference, license policy
Output Contract
- Health report per dependency (CVE count, freshness, maintainer score, license)
- Risk-scored upgrade priority matrix
- SBOM (Software Bill of Materials)
Tool Permissions
- Read: Lock files, dependency tree, CVE databases
- Write: Health reports, SBOM
- Execute: Dependency scanning tools
Execution Steps
- Parse dependency manifest and resolve full tree (direct + transitive)
- Check each dependency against CVE databases
- Score freshness (versions behind latest)
- Assess maintainer health (bus factor, commit frequency, funding)
- Check license compatibility with project distribution model
- Generate SBOM
- Produce risk-scored priority matrix
Success Criteria
- Full dependency tree analyzed (direct + transitive)
- CVE status current (within 24 hours)
- License compatibility verified
- SBOM generated
Escalation Rules
- Escalate Critical CVEs immediately
- Escalate if a direct dependency has bus factor of 1
- Escalate if GPL dependency found in proprietary project
Example Invocations
Input: "Run dependency health check on our Go service"
Output: 142 dependencies analyzed (23 direct, 119 transitive). CVEs: 0 Critical, 2 High (golang.org/x/net, google.golang.org/grpc), 5 Medium. Freshness: 4 dependencies >2 major versions behind. License: all compatible (MIT, Apache-2.0, BSD). SBOM generated. Priority: upgrade x/net immediately (CVE-2025-1234, CVSS 8.1).
1---2name: dependency-health-check3description: Assess dependency health across CVE exposure, freshness, maintainer risk, and license compatibility4---56# Dependency Health Check Skill78Assess dependency health across CVE exposure, freshness, maintainer risk, and license compatibility.910## Trigger Conditions11- Weekly automated health check cadence12- New dependency added to the project13- User invokes with "dependency health" or "check dependencies"1415## Input Contract16- **Required:** Dependency manifest (go.mod, package.json, requirements.txt)17- **Optional:** CVE database reference, license policy1819## Output Contract20- Health report per dependency (CVE count, freshness, maintainer score, license)21- Risk-scored upgrade priority matrix22- SBOM (Software Bill of Materials)2324## Tool Permissions25- **Read:** Lock files, dependency tree, CVE databases26- **Write:** Health reports, SBOM27- **Execute:** Dependency scanning tools2829## Execution Steps301. Parse dependency manifest and resolve full tree (direct + transitive)312. Check each dependency against CVE databases323. Score freshness (versions behind latest)334. Assess maintainer health (bus factor, commit frequency, funding)345. Check license compatibility with project distribution model356. Generate SBOM367. Produce risk-scored priority matrix3738## Success Criteria39- Full dependency tree analyzed (direct + transitive)40- CVE status current (within 24 hours)41- License compatibility verified42- SBOM generated4344## Escalation Rules45- Escalate Critical CVEs immediately46- Escalate if a direct dependency has bus factor of 147- Escalate if GPL dependency found in proprietary project4849## Example Invocations5051**Input:** "Run dependency health check on our Go service"5253**Output:** 142 dependencies analyzed (23 direct, 119 transitive). CVEs: 0 Critical, 2 High (golang.org/x/net, google.golang.org/grpc), 5 Medium. Freshness: 4 dependencies >2 major versions behind. License: all compatible (MIT, Apache-2.0, BSD). SBOM generated. Priority: upgrade x/net immediately (CVE-2025-1234, CVSS 8.1).
diegosouzapw