1.3K skills · sorted by relevance
Inspect Python and JavaScript dependency files for missing version constraints, duplicate entries, conflicting exact versions, and outdated Python compatibility packages. Get plain-language explanations and focused repair suggestions, with offline checks by default.
Find dependency confusion risks, where a public package can replace an internal package with the same name. Review dependency files, identify exposed names, and guide registry restrictions and recurring CI checks to prevent substitution.
Screen dependency names on npm, PyPI, and crates.io before installation to find lookalikes of legitimate packages. This skill compares spelling patterns and registry metadata, helping review AI-generated lists, lockfile changes, and new dependencies in CI/CD.
Review dependency manifests and lockfiles to find outdated packages and known security vulnerabilities. Group proposed updates by version change, report current and suggested versions, and identify updates that need human review.
Assess weaknesses in the software supply chain, from dependency packages to build pipelines and distributed artifacts. Covers authorized proof-of-concept testing, package confusion, container image risks, signing abuse, and defensive checks for tampering.
Assess dependency confusion, where a build retrieves a public package instead of an intended private one. Discover internal package names, review registry settings, plan callback-based proofs of execution, and document fixes across major package ecosystems.
Set up dependency-cruiser in a TypeScript project to enforce package boundaries, keep internal files private, and detect circular dependencies. Includes an example package, verification of the rules, and documentation for future development.
Complete a Dependabot update across a monorepo by updating matching dependency versions in other packages and regenerating bun.lock. Check the changed files, preserve existing version prefixes, then commit and push the fixes.
Audit dependency files across eight language ecosystems for built-in vulnerability patterns, license conflicts, and indirect dependency risks. Generate a prioritized upgrade plan with testing and rollback notes, and pair results with live audit tools for current vulnerability coverage.
Set up dependency-cruiser in a TypeScript repository to enforce package boundaries: outside code uses public entry files while implementation stays in subfolders. Add checks, a starter package, and documentation, then verify that forbidden imports fail.
Use when planning, implementing, or reviewing frontend dependency upgrades, package migrations, lockfile changes, major framework version bumps, CVE remediation, peer dependency conflicts, ESM/CJS shifts, build-tool compatibility, or CI verification matrices; Chinese triggers include dependency upgrades, version upgrades, lockfile, peer dependency, CVE fixes, major version migrations.
The English summary is being prepared. Showing the original description.
Check third-party packages for known security vulnerabilities, review dependency versions and lock files, and plan updates or replacements. The skill also guides automated scanning in CI, the pipeline that runs project checks.
Connect CommunityToolkit.Mvvm ViewModels to Microsoft.Extensions.DependencyInjection, which supplies their required services. Get guidance on startup setup, instance lifetimes, messaging, view integration, and replacing dependencies in tests across supported .NET user interface frameworks.
Configure GitHub Dependabot to keep dependencies, the packages a project relies on, updated. Organize update pull requests into groups, set schedules and exclusion rules, and configure security updates across projects with multiple packages or package systems.
Inspect npm packages and dependency files for malicious installation scripts, credential theft, and self-spreading behavior. Use GuardDog scanning, source inspection, known-malicious version checks, and isolated execution to produce an evidence-based assessment.
Update outdated project packages on an isolated branch, handle changes that break compatibility, and run installation, code checks, builds, tests, and security audits. Open a pull request only after every required check passes, with deferred upgrades recorded.
Review dependency files to find outdated packages and security vulnerabilities. Sort updates by severity and version change, identify cases needing human review, and record a prioritized update list with testing requirements.
Configure dependency injection in .NET MAUI, a way to supply objects with the services they need. Covers service registration, instance lifetimes, page and ViewModel constructors, Shell navigation, platform implementations, and test substitutions.
Dependency management for Golang projects — go.mod and go.sum, `go get` install and upgrade flows, Minimal Version Selection, conflict resolution with replace/exclude/retract, `govulncheck` scanning of the module tree, outdated dependency and binary size auditing, vendoring, `tool` directives, and go.work workspaces. Use when adding, removing, or upgrading Go dependencies, deciding whether to take on a package, resolving version conflicts, or auditing what a module pulls in. Covers choosing and upgrading dependency versions, not the surrounding tooling: do NOT use for fixing an exploitable vulnerability in code (→ See `samber/cc-skills-golang@golang-security` skill) or for wiring Dependabot/Renovate update bots into CI workflows (→ See `samber/cc-skills-golang@golang-continuous-integration` skill).
The English summary is being prepared. Showing the original description.
Manage third-party libraries, runtimes, and SaaS dependencies. Use this skill when setting an update cadence, responding to security advisories, dealing with deprecated dependencies, evaluating new dependencies, auditing what's installed, or unblocking a dependency upgrade. Triggers on dependency, package update, security patch, lockfile, deprecated, breaking change, supply chain, dependency audit, npm audit, dependabot, renovate. Also triggers when a build breaks after an update or when an advisory is published for a used package.
The English summary is being prepared. Showing the original description.
Audit and reduce JavaScript package dependency footprint across npm, pnpm, Yarn, and Bun projects. Use when asked to remove unused dependencies, deduplicate workspace dependency versions, lockfiles or node_modules, analyze direct dependencies' transitive lockfile closure, find low-risk upgrades that reduce dependency trees, inline trivial dependencies, or apply e18e dependency replacement recommendations.
The English summary is being prepared. Showing the original description.
Identify, analyze, and manage software dependencies before deployment. Use this skill when preparing applications for deployment, resolving dependency conflicts, updating dependencies, auditing security vulnerabilities, managing package versions, or troubleshooting dependency-related issues. Supports multiple package managers (npm, pip, maven, cargo, go mod, composer) and provides actionable recommendations for dependency management.
The English summary is being prepared. Showing the original description.
Provides dependency management and supply chain security practices for auditing vulnerabilities, checking licenses, assessing dependency health, and managing upgrades safely. Use when auditing packages, reviewing security, managing dependencies, or when user mentions 'audit', 'vulnerability', 'dependency', 'supply chain', 'npm audit', 'license', 'bundle size'.
The English summary is being prepared. Showing the original description.
Python dependency management with Poetry and Rye -- lockfile-driven workflows, dependency groups, monorepo patterns, and migration paths. Covers pyproject.toml-centric packaging for projects not yet on uv.
The English summary is being prepared. Showing the original description.