How do I install the Deps skill?

Run npx skillmds@latest add maggit/deps in your terminal (requires Node.js), paste this page's agent-chat prompt into Claude, Cursor, or any MCP-connected agent, or download the SKILL.md file and copy it into your agent's skills directory.

This skill has not completed SkillMD's automated safety review yet. Capability flags: docs only. SkillMD never runs a skill's scripts for you; review the SKILL.md before installing.

Which AI agents work with Deps?

This skill is tagged as working with Claude Code, Claude.ai, OpenAI Codex. SKILL.md is an open format, so most agents that read a skills directory can load it too.

Yes. Installing skills from SkillMD is free, and the skill stays under its author's original license.

maggit (@maggit) published this skill. Their other Agent Skills are listed on their SkillMD profile.

Deps by maggit — Agent Skill

Name: Deps
Rating: 4.2 (5 reviews)
Author: maggit

Deps

Analyze, audit, and manage project dependencies. Use when the user says /deps, asks to check dependencies, find outdated packages, audit for vulnerabilities, analyze dependency trees, or clean up unused packages. Triggers: deps, dependencies, outdated, audit, vulnerabilities, upgrade packages, dependency tree, unused packages, npm audit, pip audit.

maggit Updated Sep 10, 2026

File contents

Dependency Manager

Analyze, audit, and manage project dependencies.

Workflow

Detect the package ecosystem:
- package.json → npm/yarn/pnpm
- pyproject.toml / requirements.txt → pip/poetry/uv
- Cargo.toml → cargo
- go.mod → Go modules
- Gemfile → bundler
- pom.xml / build.gradle → Maven/Gradle
Run the requested analysis:

Outdated Dependencies

npm outdated / yarn outdated / pnpm outdated
pip list --outdated
cargo outdated (if installed)
go list -u -m all
Present as a table: package, current, wanted, latest, type (major/minor/patch).

Security Audit

npm audit / yarn audit / pnpm audit
pip audit / safety check
cargo audit
govulncheck ./...
Categorize findings by severity (critical, high, medium, low).
For each vulnerability, show: package, severity, description, fix available.

Unused Dependencies

Cross-reference declared dependencies against actual imports in the codebase.
Check devDependencies vs runtime usage.
Flag dependencies that are declared but never imported.

Dependency Tree Analysis

npm ls --all / yarn why <pkg> / pnpm why <pkg>
pipdeptree
Identify duplicate packages at different versions.
Find heavy transitive dependencies.

Upgrade Plan

For major upgrades, generate a plan:

1. Upgrade <package> from v2.x to v3.x
   - Breaking changes: <list from changelog>
   - Required code changes: <files affected>
   - Risk: <low/medium/high>

Present findings with actionable recommendations.

Guidelines

Always show the impact before suggesting upgrades (breaking changes, migration effort).
For security vulnerabilities, prioritize by exploitability and exposure, not just CVSS score.
Suggest pinning strategies: exact versions for apps, ranges for libraries.
Warn about packages that are unmaintained (no commits in >1 year, deprecated).
Don't auto-upgrade — always present the plan and get user confirmation.
Check license compatibility if the user asks or if the project has a LICENSE file.

---name: depsdescription: Analyze, audit, and manage project dependencies. Use when the user says /deps, asks to check dependencies, find outdated packages, audit for vulnerabilities, analyze dependency trees, or clean up unused packages. Triggers: deps, dependencies, outdated, audit, vulnerabilities, upgrade packages, dependency tree, unused packages, npm audit, pip audit.---# Dependency ManagerAnalyze, audit, and manage project dependencies.## Workflow1. **Detect the package ecosystem:** - `package.json` → npm/yarn/pnpm - `pyproject.toml` / `requirements.txt` → pip/poetry/uv - `Cargo.toml` → cargo - `go.mod` → Go modules - `Gemfile` → bundler - `pom.xml` / `build.gradle` → Maven/Gradle2. **Run the requested analysis:**### Outdated Dependencies- `npm outdated` / `yarn outdated` / `pnpm outdated`- `pip list --outdated`- `cargo outdated` (if installed)- `go list -u -m all`- Present as a table: package, current, wanted, latest, type (major/minor/patch).### Security Audit- `npm audit` / `yarn audit` / `pnpm audit`- `pip audit` / `safety check`- `cargo audit`- `govulncheck ./...`- Categorize findings by severity (critical, high, medium, low).- For each vulnerability, show: package, severity, description, fix available.### Unused Dependencies- Cross-reference declared dependencies against actual imports in the codebase.- Check `devDependencies` vs runtime usage.- Flag dependencies that are declared but never imported.### Dependency Tree Analysis- `npm ls --all` / `yarn why <pkg>` / `pnpm why <pkg>`- `pipdeptree`- Identify duplicate packages at different versions.- Find heavy transitive dependencies.### Upgrade PlanFor major upgrades, generate a plan:```1. Upgrade <package> from v2.x to v3.x - Breaking changes: <list from changelog> - Required code changes: <files affected> - Risk: <low/medium/high>```3. **Present findings with actionable recommendations.**## Guidelines- Always show the impact before suggesting upgrades (breaking changes, migration effort).- For security vulnerabilities, prioritize by exploitability and exposure, not just CVSS score.- Suggest pinning strategies: exact versions for apps, ranges for libraries.- Warn about packages that are unmaintained (no commits in >1 year, deprecated).- Don't auto-upgrade — always present the plan and get user confirmation.- Check license compatibility if the user asks or if the project has a LICENSE file.

Frequently asked questions