How do I install the Deps Doctor skill?

Run npx skillmds@latest add llp42/deps-doctor in your terminal (requires Node.js), paste this page's agent-chat prompt into Claude, Cursor, or any MCP-connected agent, or download the SKILL.md file and copy it into your agent's skills directory.

Is Deps Doctor safe to use?

This skill has not completed SkillMD's automated safety review yet. Capability flags: docs only. SkillMD never runs a skill's scripts for you; review the SKILL.md before installing.

Which AI agents work with Deps Doctor?

This skill is tagged as working with Claude Code, Claude.ai, OpenAI Codex. SKILL.md is an open format, so most agents that read a skills directory can load it too.

Is Deps Doctor free to use?

Yes. Installing skills from SkillMD is free, and the skill stays under its author's original license.

Who published Deps Doctor?

llp42 (@llp42) published this skill. Their other Agent Skills are listed on their SkillMD profile.

Deps Doctor by llp42 — Agent Skill

Name: Deps Doctor
Rating: 4.2 (5 reviews)
Author: llp42

Deps Doctor

MUST be used whenever the user asks to audit dependencies for outdated versions or known vulnerabilities across the whole project (not just a diff). This complements the separate `deps-summary` skill, which only reports version deltas already present in a git diff — this one actively audits the current lockfile state regardless of any diff. Always invoke this instead of running npm/pip/cargo audit commands manually.

llp42 Updated Sep 22, 2026

File contents

Audit project dependencies for outdated versions and known vulnerabilities. Report only — never modify files, install packages, or run upgrade commands.

Steps:

Detect ecosystems present in the project root by checking for these files:
- package.json → npm/yarn/pnpm (JS/TS)
- requirements.txt or pyproject.toml → pip (Python)
- Cargo.toml → cargo (Rust)
- go.mod → Go modules
For each detected ecosystem, run the applicable commands. If a tool isn't installed or a command errors, note it briefly for that ecosystem and continue — do not fail the whole report.
- JS/TS: npm outdated and npm audit --json
- Python: pip list --outdated; if pip-audit is available, also run pip-audit
- Rust: cargo outdated if installed; cargo audit if installed
- Go: go list -u -m all for outdated modules. Go has no built-in vuln scanner — skip vulnerability scanning unless govulncheck is present, and note that it was skipped.
Parse output into a compact plain-English report. For each flagged package include: name, current version, latest available version, and vulnerability severity (critical/high/medium/low) if flagged by an audit tool.
Sort the report so critical/high-severity vulnerabilities appear first, clearly marked (e.g. "⚠ HIGH", "⚠ CRITICAL"), followed by medium/low vulnerabilities, then plain outdated-version-only entries. Group by ecosystem if more than one is present.
Do not modify any files or run any upgrade/install commands. This skill only reports findings.

---name: deps-doctordescription: MUST be used whenever the user asks to audit dependencies for outdated versions or known vulnerabilities across the whole project (not just a diff). This complements the separate `deps-summary` skill, which only reports version deltas already present in a git diff — this one actively audits the current lockfile state regardless of any diff. Always invoke this instead of running npm/pip/cargo audit commands manually.---Audit project dependencies for outdated versions and known vulnerabilities. Report only — never modify files, install packages, or run upgrade commands.Steps:1. **Detect ecosystems** present in the project root by checking for these files: - `package.json` → npm/yarn/pnpm (JS/TS) - `requirements.txt` or `pyproject.toml` → pip (Python) - `Cargo.toml` → cargo (Rust) - `go.mod` → Go modules2. **For each detected ecosystem**, run the applicable commands. If a tool isn't installed or a command errors, note it briefly for that ecosystem and continue — do not fail the whole report. - **JS/TS**: `npm outdated` and `npm audit --json` - **Python**: `pip list --outdated`; if `pip-audit` is available, also run `pip-audit` - **Rust**: `cargo outdated` if installed; `cargo audit` if installed - **Go**: `go list -u -m all` for outdated modules. Go has no built-in vuln scanner — skip vulnerability scanning unless `govulncheck` is present, and note that it was skipped.3. **Parse output** into a compact plain-English report. For each flagged package include: name, current version, latest available version, and vulnerability severity (critical/high/medium/low) if flagged by an audit tool.4. **Sort the report** so critical/high-severity vulnerabilities appear first, clearly marked (e.g. "⚠ HIGH", "⚠ CRITICAL"), followed by medium/low vulnerabilities, then plain outdated-version-only entries. Group by ecosystem if more than one is present.5. **Do not modify any files or run any upgrade/install commands.** This skill only reports findings.

Frequently asked questions