About

Imported from daryllundy/claude-skills-library (.claude/skills/dependency-specialist/SKILL.md). Install upstream with npx skills add daryllundy/claude-skills-library --skill dependency-specialist. Copyright stays with the author.

Dependency Specialist

Name: dependency-specialist
Author: daryllundy

Activation criteria

User language explicitly matches trigger phrases such as update dependencies, version conflict, npm audit.
The requested work fits this skill's lane: Updating dependencies, resolving conflicts, security audits, Renovate/Dependabot setup.
The task stays inside this skill's boundary and avoids adjacent areas called out as out of scope: Application code changes caused by breaking dependency updates.

First actions

Glob('**/package.json', '**/requirements.txt', '**/Pipfile', '**/go.mod', '**/Cargo.toml', '**/pom.xml', '**/build.gradle') — identify package manager(s) in use
Read the manifest file and lock file (package-lock.json, Pipfile.lock, go.sum, etc.)
For security audits: run npm audit, pip-audit, cargo audit, or govulncheck depending on ecosystem

Decision rules

For security vulnerabilities: fix CRITICAL and HIGH first; document MEDIUM/LOW for backlog
For major version updates: check changelog for breaking changes before upgrading; update one major dependency at a time
If a lock file is missing: generate it before making any other changes
For supply chain: prefer packages with active maintenance (recent commits, responsive maintainers)

Output contract

For security audits: structured table — Package | Version | CVE | Severity | Fix Version | Status
For updates: exact commands to run; note any breaking changes that require code changes

Constraints

NEVER update all dependencies in one commit — update in batches by severity or ecosystem
Scope boundary: fixing breaking changes in application code after a dependency update belongs to the relevant language/framework skill

Reference

references/legacy-agent.md: package manager reference, CVE tracking, automated update tools, monorepo dependency management

Use it

Copy one of these into your project. Installing also returns the manifest and these snippets.

yaml

targets:
  - https://api.opensmartroute.ai/api/v1/registry/daryllundy-claude-skills-library-dependency-specialist/manifest   # or paste the manifest below

Manifest

An Open Capability Manifest: the router reads it to know what this does, what it costs and when to pick it.

daryllundy-claude-skills-library-dependency-specialist.ocm.jsonjson

{
  "ocm": "1",
  "id": "daryllundy-claude-skills-library-dependency-specialist",
  "kind": "skill",
  "name": "dependency-specialist",
  "description": "Dependency management, version conflict resolution, security patch updates, and supply chain hygiene across npm, pip, Maven, Cargo, and Go modules. Use when asked to update dependencies, resolve a version conflict, audit for vulnerabilities, set up Dependabot or Renovate, fix a broken lock file, or evaluate whether to add or remove a package.",
  "publisher": "daryllundy",
  "version": "1.0.0",
  "capabilities": {
    "domains": [
      "coding"
    ],
    "tags": [
      "skill-md",
      "dependencies",
      "npm",
      "pip",
      "maven",
      "cargo",
      "go-modules",
      "renovate",
      "dependabot",
      "security"
    ],
    "languages": [
      "en"
    ]
  },
  "quality_prior": 0.6,
  "examples": [
    "Dependency management, version conflict resolution, security patch updates, and supply chain hygiene across npm, pip, Maven, Cargo, and Go modules. Use when asked to update dependencies, resolve a version conflict, audit for vulnerabilities, set up Dependabot or Renovate, fix a broken lock file, or evaluate whether to add or remove a package."
  ],
  "primary": false,
  "metadata": {
    "source": {
      "provider": "github",
      "repository": "https://github.com/daryllundy/claude-skills-library",
      "path": ".claude/skills/dependency-specialist/SKILL.md",
      "ref": "208492d8126f43214dc56e05433d6d53d41fff2f",
      "url": "https://github.com/daryllundy/claude-skills-library/blob/208492d8126f43214dc56e05433d6d53d41fff2f/.claude/skills/dependency-specialist/SKILL.md",
      "key": "daryllundy/claude-skills-library/.claude/skills/dependency-specialist/SKILL.md"
    },
    "allowed_tools": [
      "Read",
      "Write",
      "Bash",
      "Grep",
      "Glob"
    ]
  },
  "instructions": "# Dependency Specialist\n\n## Activation criteria\n- User language explicitly matches trigger phrases such as `update dependencies`, `version conflict`, `npm audit`.\n- The requested work fits this skill's lane: Updating dependencies, resolving conflicts, security audits, Renovate/Dependabot setup.\n- The task stays inside this skill's boundary and avoids adjacent areas called out as out of scope: Application code changes caused by breaking dependency updates.\n\n## First actions\n1. `Glob('**/package.json', '**/requirements.txt', '**/Pipfile', '**/go.mod', '**/Cargo.toml', '**/pom.xml', '**/build.gra",
  "cost": {
    "context_tokens": 461
  }
}

Fetch it by URL: GET /api/v1/registry/daryllundy-claude-skills-library-dependency-specialist/manifest?version=1.0.0

Reviews

Star ratings from people who tried it. One review per account; edit yours any time.

No reviews yet. Install it, try it, and be the first to rate it.