analyze-dependencies
Audit project dependencies for risk when the user asks to check dependencies, audit packages, review dependency health, check for vulnerabilities, or assess supply chain risk
npx skills add majiayu000/claude-skill-registry --skill analyze-dependencies-generaljerel-chalk-skills --agent claude-code
Same command for any agent — swap --agent for codex, cursor, copilot.
Weekly change comes from our own snapshots, not the repository page — it measures attention, not adoption.
# Analyze Dependencies ## Overview Audit the project's dependency tree across five risk dimensions: freshness, vulnerabilities, bundle impact, license compliance, and maintenance status. Produce a risk-scored report with actionable recommendations for each dependency. ## Workflow 1. **Read project context** — Check `.chalk/docs/engineering/` for: - Architecture docs (to understand which dependencies are critical path) - Previous dependency audits - Any documented dependency policies or license requirements 2. **Locate dependency manifests** — Scan the project for: - `package.json` / `package-lock.json` / `yarn.lock` / `pnpm-lock.yaml` (Node.js) - `pyproject.toml` / `requirements.txt` / `Pipfile` / `poetry.lock` (Python) - `pubspec.yaml` / `pubspec.lock` (Dart/Flutter) - `Cargo.toml` / `Cargo.lock` (Rust) - `go.mod` / `go.sum` (Go) - `Gemfile` / `Gemfile.lock` (Ruby) - `pom.xml` / `build.gradle` (Java/Kotlin) - If `$ARGUMENTS` specifies a file, focus on that manifest 3. **Inventory dependencies** — For each manifest, list: - Direct dependencies (production) - Direct dev dependencies - Note the declared version constraints (exact, range, caret, tilde) 4. **Assess freshness** — For ea
- Overview
- Workflow
- Filename Convention
- Dependency Audit Format
- Risk Scoring Matrix
- Anti-patterns
What does the analyze-dependencies skill do?
Audit project dependencies for risk when the user asks to check dependencies, audit packages, review dependency health, check for vulnerabilities, or assess supply chain risk
How do I install it?
Run `npx skills add majiayu000/claude-skill-registry --skill analyze-dependencies-generaljerel-chalk-skills --agent claude-code` — it drops the skill into your project so the agent can pick it up. Swap the --agent value for codex, cursor or copilot if you use one of those.
Where does this skill come from?
From majiayu000/claude-skill-registry, a repository with 534 stars. We read it straight from the repository tree rather than a submitted listing, so what you see here is what is actually published.
Is a popular skill a good skill?
Not necessarily. Stars measure attention, not adoption — a repository can trend for a week and be abandoned. That is why we show the weekly change from our own snapshots next to the total, instead of a single flattering number.