How do I install the Deps Mgmt skill?

Run npx skillmds@latest add gabrielmoreira/deps-mgmt in your terminal (requires Node.js), paste this page's agent-chat prompt into Claude, Cursor, or any MCP-connected agent, or download the SKILL.md file and copy it into your agent's skills directory.

Is Deps Mgmt safe to use?

This skill has not completed SkillMD's automated safety review yet. Independent scanners report: SkillSpector: PASS, Skill Scanner: PASS. Capability flags: docs only. SkillMD never runs a skill's scripts for you; review the SKILL.md before installing.

Which AI agents work with Deps Mgmt?

This skill is tagged as working with Claude Code, Claude.ai, OpenAI Codex. SKILL.md is an open format, so most agents that read a skills directory can load it too.

Is Deps Mgmt free to use?

Yes. Installing skills from SkillMD is free, and the skill stays under its author's original license.

Who published Deps Mgmt?

gabrielmoreira (@gabrielmoreira) published this skill. Their other Agent Skills are listed on their SkillMD profile.

Deps Mgmt by gabrielmoreira — Agent Skill

Name: Deps Mgmt
Rating: 4.2 (5 reviews)
Author: gabrielmoreira

Deps Mgmt

Deep dependency management workflow—inventory, upgrade policy, security patches, licensing, lockfiles, and supply-chain hygiene. Use when upgrading frameworks, resolving CVEs, or standardizing how teams pin dependencies.

gabrielmoreira Updated Sep 9, 2026 17 repo stars

File contents

Dependencies

Dependencies are supply-chain surface area: versions affect security, reproducibility, and upgrade cost.

When to Offer This Workflow

Trigger conditions:

Dependabot noise; major version upgrades
CVE response or license audit
“Works on my machine” due to unpinned dependencies

Initial offer:

Use six stages: (1) inventory & risk, (2) policy & cadence, (3) lockfiles & reproducibility, (4) upgrades & testing, (5) security & licensing, (6) governance & tooling). Confirm ecosystem (npm, pip, Maven, Go modules, etc.).

Stage 1: Inventory & Risk

Goal: Direct vs transitive dependencies; flag critical packages (crypto, auth, parsing, serialization).

Exit condition: SBOM or export for top applications; list of critical deps.

Stage 2: Policy & Cadence

Goal: When to upgrade (time-based vs on-demand); SemVer rules for libraries vs applications.

Stage 3: Lockfiles & Reproducibility

Goal: Committed lockfiles for deployable apps; libraries test against a compatibility matrix instead of one frozen lock.

Stage 4: Upgrades & Testing

Goal: Prefer one major bump per PR when feasible; CI matrix on supported language/runtime versions.

Stage 5: Security & Licensing

Goal: SCA scanning; patch SLA by severity; license allowlist for compliance.

Stage 6: Governance & Tooling

Goal: Renovate/Bot policies; pin internal packages; document exceptions and overrides.

Final Review Checklist

Inventory and risk hotspots known
Upgrade cadence and semver policy documented
Lockfiles or matrix strategy per repo type
CI validates upgrades
SCA and license policy enforced

Tips for Effective Guidance

Transitive CVEs may need overrides—trace the dependency graph.
Pin CI images and toolchains, not only application dependencies.

Handling Deviations

Monorepos: shared versions with Nx/Bazel/etc.—coordinate breaking upgrades.

---name: deps-mgmtdescription: Deep dependency management workflow—inventory, upgrade policy, security patches, licensing, lockfiles, and supply-chain hygiene. Use when upgrading frameworks, resolving CVEs, or standardizing how teams pin dependencies.--- # Dependencies Dependencies are **supply-chain** surface area: versions affect security, reproducibility, and upgrade cost. ## When to Offer This Workflow **Trigger conditions:** - Dependabot noise; major version upgrades - CVE response or license audit - “Works on my machine” due to unpinned dependencies **Initial offer:** Use **six stages**: (1) inventory & risk, (2) policy & cadence, (3) lockfiles & reproducibility, (4) upgrades & testing, (5) security & licensing, (6) governance & tooling). Confirm ecosystem (npm, pip, Maven, Go modules, etc.). --- ## Stage 1: Inventory & Risk **Goal:** Direct vs transitive dependencies; flag critical packages (crypto, auth, parsing, serialization). **Exit condition:** SBOM or export for top applications; list of critical deps. --- ## Stage 2: Policy & Cadence **Goal:** When to upgrade (time-based vs on-demand); SemVer rules for libraries vs applications. --- ## Stage 3: Lockfiles & Reproducibility **Goal:** Committed lockfiles for deployable apps; libraries test against a compatibility matrix instead of one frozen lock. --- ## Stage 4: Upgrades & Testing **Goal:** Prefer one major bump per PR when feasible; CI matrix on supported language/runtime versions. --- ## Stage 5: Security & Licensing **Goal:** SCA scanning; patch SLA by severity; license allowlist for compliance. --- ## Stage 6: Governance & Tooling **Goal:** Renovate/Bot policies; pin internal packages; document exceptions and overrides. --- ## Final Review Checklist - [ ] Inventory and risk hotspots known - [ ] Upgrade cadence and semver policy documented - [ ] Lockfiles or matrix strategy per repo type - [ ] CI validates upgrades - [ ] SCA and license policy enforced ## Tips for Effective Guidance - Transitive CVEs may need overrides—trace the dependency graph. - Pin CI images and toolchains, not only application dependencies. ## Handling Deviations - Monorepos: shared versions with Nx/Bazel/etc.—coordinate breaking upgrades.

Frequently asked questions