dependency-doctor

Name: dependency-doctor
Author: Rune-kit

80stars21forks

How to install dependency-doctor?

rune-kit/rune/dependency-doctor

$npx -y skills add Rune-kit/rune --skill dependency-doctor

Installs into the current project.

Summary

Dependency health management. Detects package manager, checks outdated packages and vulnerabilities, and produces a prioritized update plan.

Files · 1

View on GitHub

SKILL.md

1	# dependency-doctor
2
3	## Purpose
4
5	Dependency health management covering outdated packages, known vulnerabilities, and update planning. Detects the package manager automatically, runs audit commands, analyzes breaking changes for major version bumps, and outputs a prioritized update plan with risk assessment.
6
7	## Called By (inbound)
8
9	- `rescue` (L1): Phase 0 dependency health assessment
10	- `audit` (L2): Phase 1 vulnerability scan and outdated dependency check
11
12	## Calls (outbound)
13
14	None — pure L3 utility using Bash for package manager commands.
15
16	## Executable Instructions
17
18	### Step 1: Detect Package Manager
19
20	Use `Glob` to find dependency files in the project root:
21
22	- `package.json` → Node.js (npm, yarn, or pnpm)
23	- `requirements.txt` or `pyproject.toml` → Python (pip or uv)
24	- `Cargo.toml` → Rust (cargo)
25	- `go.mod` → Go (go)
26	- `Gemfile` → Ruby (bundler)
27
28	If multiple are found, process all of them. If none found, report NO_DEPENDENCY_FILES and stop.
29
30	For Node.js, further detect the package manager:
31	- `yarn.lock` present → yarn
32	- `pnpm-lock.yaml` present → pnpm
33	- `package-lock.json` present → npm
34	- None → default to npm
35
36	### Step 2: List Dependencies
37
38	Use `Read` to parse the dependency file and extract:
39	- Package name
40	- Current version constraint
41	- Whether it is a dev dependency or production dependency
42
43	For `package.json`, read both `dependencies` and `devDependencies` sections.
44
45	### Step 3: Check Outdated
46
47	Run the appropriate command via `Bash` to find outdated packages:
48
49	npm:
50	```bash
51	npm outdated --json
52	```
53
54	yarn:
55	```bash
56	yarn outdated --json
57	```
58
59	pnpm:
60	```bash
61	pnpm outdated
62	```
63
64	pip:
65	```bash
66	pip list --outdated --format=json
67	```
68
69	cargo:
70	```bash
71	cargo outdated
72	```
73
74	go:
75	```bash
76	go list -u -m all
77	```
78
79	Parse the output to extract for each outdated package:
80	- Current version
81	- Latest version
82	- Update type: `patch` \| `minor` \| `major`
83
84	### Step 4: Check Vulnerabilities
85
86	Run the appropriate audit command via `Bash`:
87
88	npm:
89	```bash
90	npm audit --json
91	```
92
93	yarn:
94	```bash
95	yarn audit --json
96	```
97
98	pnpm:
99	```bash
100	pnpm audit --json
101	```
102
103	pip:
104	```bash
105	pip-audit --format json
106	```
107
108	cargo:
109	```bash
110	cargo audit --json
111	```
112
113	If the audit tool is not installed, note it as TOOL_MISSING and skip this step (do not fail).
114
115	Parse the output to extract:
116	- Package name + vulnerable version
117	- CVE ID (if available)
118	- Severity: `critical` \| `high` \| `moderate` \| `low`
119	- Fixed version (if available)
120
121	### Step 5: Analyze Breaking Changes
122
123	For each package with a major version bump (e.g. v2 → v3):
124
125	Use `rune:docs-seeker` to look up migration guides if available, or note:
126	- "Breaking change analysis required before updating [package] from v[X] to v[Y]"
127
128	Do not blindly recommend major updates without flagging migration risk.
129
130	### Step 6: Generate Update Plan
131
132	Create a prioritized update plan:
133
134	Priority order:
135	1. CRITICAL — packages with critical/high CVEs → update immediately
136	2. SECURITY — packages with moderate/low CVEs → update in current sprint
137	3. PATCH — patch version bumps, no breaking changes → safe to batch update
138	4. MINOR — minor version bumps, new features added → update with testing
139	5. MAJOR — major version bumps, breaking changes → plan migration separately
140
141	For each item in the plan, include:
142	- Package name + current → target version
143	- Update type and risk level
144	- Migration notes (for major updates)
145	- Suggested command to run the update
146
147	### Step 7: Report
148
149	Output the following structure:
150
151	```
152	## Dependency Report: [project name]
153
154	- Package Manager: [npm\|yarn\|pnpm\|pip\|cargo\|go]
155	- Total Dependencies: [count]
156	- Outdated: [count]
157	- Vulnerable: [count] ([critical] critical, [high] high, [moderate] moderate)
158
159	### Critical — CVEs (Fix Immediately)
160	- [package]@[current] — [CVE-ID] ([severity]): [description]
161	Fix: npm update [package]@[fixed_version]
162
163	### Security — CVEs (Fix This Sprint)
164	- [package]@[current] — [CVE-ID] ([severity]): [description]
165
166	### Outdated — Patch (Safe to Update)
167	- [package]@[current] → [latest] (patch)
168
169	### Outdated — Minor (Update with Testing)
170	- [package]@[current] → [latest] (minor)
171
172	### Outdated — Major (Plan Migration)
173	- [package]@[current] → [latest] (major) — migration guide required
174
175	### Unused Dependencies
176	- [package] — no imports found in src/
177
178	### Update Plan (Ordered by Risk)
179	1. [command] — fixes [CVE-ID]
180	2. [command] — patch updates (safe batch)
181	3. [command] — requires migration: [notes]
182
183	### Dependency Health Score
184	- Score: [0-100]
185	- Grade: A (80-100) \| B (60-79) \| C (40-59) \| D (<40)
186	- Score basis: -10 per critical CVE, -5 per high CVE, -2 per outdated major, -1 per outdated minor
187	```
188
189	## Upgrade Campaign Mode
190
191	When health

People who liked this also viewed

6 picks

Type

find-skillsHelps users discover and install agent skills when they ask questions like "how do I do X", "find a skill for X", "is there a skill that can...", or express interest in extending capabilities. This skSkillsJul 20262.6M27k
grill-meA relentless interview to sharpen a plan or design.SkillsJul 2026633k182k
vercel-react-best-practicesVercel's official collection of agent skillsSkillsJul 2026573k29k
improve-codebase-architectureScan a codebase for deepening opportunities, present them as a visual HTML report, then grill through whichever one you pick.SkillsJul 2026522k182k
setup-matt-pocock-skillsConfigure this repo for the engineering skills — set up its issue tracker, triage label vocabulary, and domain doc layout. Run once before first use of the other engineering skills.SkillsJul 2026454k182k
triageMove issues and external PRs through a state machine of triage roles — categorise, verify, grill if needed, and write agent-ready briefs.SkillsJul 2026424k182k

dependency-doctor

80stars21forks

View on GitHub

How to install dependency-doctor?

rune-kit/rune/dependency-doctor

$npx -y skills add Rune-kit/rune --skill dependency-doctor

Installs into the current project.

Summary

Dependency health management. Detects package manager, checks outdated packages and vulnerabilities, and produces a prioritized update plan.

Files · 1

View on GitHub

SKILL.md

1	# dependency-doctor
2
3	## Purpose
4
5	Dependency health management covering outdated packages, known vulnerabilities, and update planning. Detects the package manager automatically, runs audit commands, analyzes breaking changes for major version bumps, and outputs a prioritized update plan with risk assessment.
6
7	## Called By (inbound)
8
9	- `rescue` (L1): Phase 0 dependency health assessment
10	- `audit` (L2): Phase 1 vulnerability scan and outdated dependency check
11
12	## Calls (outbound)
13
14	None — pure L3 utility using Bash for package manager commands.
15
16	## Executable Instructions
17
18	### Step 1: Detect Package Manager
19
20	Use `Glob` to find dependency files in the project root:
21
22	- `package.json` → Node.js (npm, yarn, or pnpm)
23	- `requirements.txt` or `pyproject.toml` → Python (pip or uv)
24	- `Cargo.toml` → Rust (cargo)
25	- `go.mod` → Go (go)
26	- `Gemfile` → Ruby (bundler)
27
28	If multiple are found, process all of them. If none found, report NO_DEPENDENCY_FILES and stop.
29
30	For Node.js, further detect the package manager:
31	- `yarn.lock` present → yarn
32	- `pnpm-lock.yaml` present → pnpm
33	- `package-lock.json` present → npm
34	- None → default to npm
35
36	### Step 2: List Dependencies
37
38	Use `Read` to parse the dependency file and extract:
39	- Package name
40	- Current version constraint
41	- Whether it is a dev dependency or production dependency
42
43	For `package.json`, read both `dependencies` and `devDependencies` sections.
44
45	### Step 3: Check Outdated
46
47	Run the appropriate command via `Bash` to find outdated packages:
48
49	npm:
50	```bash
51	npm outdated --json
52	```
53
54	yarn:
55	```bash
56	yarn outdated --json
57	```
58
59	pnpm:
60	```bash
61	pnpm outdated
62	```
63
64	pip:
65	```bash
66	pip list --outdated --format=json
67	```
68
69	cargo:
70	```bash
71	cargo outdated
72	```
73
74	go:
75	```bash
76	go list -u -m all
77	```
78
79	Parse the output to extract for each outdated package:
80	- Current version
81	- Latest version
82	- Update type: `patch` \| `minor` \| `major`
83
84	### Step 4: Check Vulnerabilities
85
86	Run the appropriate audit command via `Bash`:
87
88	npm:
89	```bash
90	npm audit --json
91	```
92
93	yarn:
94	```bash
95	yarn audit --json
96	```
97
98	pnpm:
99	```bash
100	pnpm audit --json
101	```
102
103	pip:
104	```bash
105	pip-audit --format json
106	```
107
108	cargo:
109	```bash
110	cargo audit --json
111	```
112
113	If the audit tool is not installed, note it as TOOL_MISSING and skip this step (do not fail).
114
115	Parse the output to extract:
116	- Package name + vulnerable version
117	- CVE ID (if available)
118	- Severity: `critical` \| `high` \| `moderate` \| `low`
119	- Fixed version (if available)
120
121	### Step 5: Analyze Breaking Changes
122
123	For each package with a major version bump (e.g. v2 → v3):
124
125	Use `rune:docs-seeker` to look up migration guides if available, or note:
126	- "Breaking change analysis required before updating [package] from v[X] to v[Y]"
127
128	Do not blindly recommend major updates without flagging migration risk.
129
130	### Step 6: Generate Update Plan
131
132	Create a prioritized update plan:
133
134	Priority order:
135	1. CRITICAL — packages with critical/high CVEs → update immediately
136	2. SECURITY — packages with moderate/low CVEs → update in current sprint
137	3. PATCH — patch version bumps, no breaking changes → safe to batch update
138	4. MINOR — minor version bumps, new features added → update with testing
139	5. MAJOR — major version bumps, breaking changes → plan migration separately
140
141	For each item in the plan, include:
142	- Package name + current → target version
143	- Update type and risk level
144	- Migration notes (for major updates)
145	- Suggested command to run the update
146
147	### Step 7: Report
148
149	Output the following structure:
150
151	```
152	## Dependency Report: [project name]
153
154	- Package Manager: [npm\|yarn\|pnpm\|pip\|cargo\|go]
155	- Total Dependencies: [count]
156	- Outdated: [count]
157	- Vulnerable: [count] ([critical] critical, [high] high, [moderate] moderate)
158
159	### Critical — CVEs (Fix Immediately)
160	- [package]@[current] — [CVE-ID] ([severity]): [description]
161	Fix: npm update [package]@[fixed_version]
162
163	### Security — CVEs (Fix This Sprint)
164	- [package]@[current] — [CVE-ID] ([severity]): [description]
165
166	### Outdated — Patch (Safe to Update)
167	- [package]@[current] → [latest] (patch)
168
169	### Outdated — Minor (Update with Testing)
170	- [package]@[current] → [latest] (minor)
171
172	### Outdated — Major (Plan Migration)
173	- [package]@[current] → [latest] (major) — migration guide required
174
175	### Unused Dependencies
176	- [package] — no imports found in src/
177
178	### Update Plan (Ordered by Risk)
179	1. [command] — fixes [CVE-ID]
180	2. [command] — patch updates (safe batch)
181	3. [command] — requires migration: [notes]
182
183	### Dependency Health Score
184	- Score: [0-100]
185	- Grade: A (80-100) \| B (60-79) \| C (40-59) \| D (<40)
186	- Score basis: -10 per critical CVE, -5 per high CVE, -2 per outdated major, -1 per outdated minor
187	```
188
189	## Upgrade Campaign Mode
190
191	When health

People who liked this also viewed

6 picks

Type