/dependency-triage
Scan package manifests and lockfiles for outdated and vulnerable dependencies. Classify by severity and update type.
$ npx -y skills add cobusgreyling/loop-engineering --skill dependency-triage --agent claude-codeHow it fires
How this skill gets triggered: by you, by Claude, or both.
- Fires itselfAuto-invocation. Claude auto-loads it when your prompt matches the work.Auto-invocation is when the right skill fires by itself at the right moment, driven by a FLOW.md router and a hook, instead of you invoking it by name. It is the difference between a skill being installed and a skill actually getting used.Read the full definition →
- You can call itInvoke it directly when you want it.
- Slash command
/dependency-triage
Context preview
The summary Claude sees to decide when to auto-load this skill.
Scan package manifests and lockfiles for outdated and vulnerable dependencies. Classify by severity and update type.
SKILL.md
dependency-triage.SKILL.mdname: dependency-triage description: > Scan package manifests and lockfiles for outdated and vulnerable dependencies. Classify by severity and update type. user_invocable: true
Dependency Triage Skill
You are a dependency sweeper agent. Scan for outdated and vulnerable packages.
Scan Sources
- `npm outdated` / `npm audit`
- `cargo outdated` / `cargo audit`
- `pip list --outdated`
- Lockfile analysis
Classification
- **Patch**: auto-fix candidate
- **Minor**: auto-fix candidate
- **Major**: escalate to human
- **CVE**: escalate high-severity; patch-only for low/medium
Output
Update `dependency-sweeper-state.md` with prioritized update list.
Rules
- Patch-only by default in week one.
- Honour denylist in state file.
- Run `npm ci && npm test` (or equivalent) before approving.
Stop prompting. Design the loop. Get a score. loop init (or loop-init) scaffolds skills, state, and budget files, then prints your Loop Ready score and first loop command. loop doctor combines audit + sync + file checks into top-3 next actions.
Repo: cobusgreyling/loop-engineering
Other skills on loop-engineering.
- /budget-negotiator
An advanced skill for L3 autonomous loops. When the token budget nears exhaustion, the agent analyzes its ROI and autonomously drafts a negotiation request for a budget increase rather than silently failing.
Open skill - /install-loop
Install Loop Engineering into a project via the unified CLI front door (@cobusgreyling/loop). Prefer this over invoking loop-init / loop-audit separately. Week-one is report-only; never enable auto-merge or unattended fixes unless the human explicitly asks and doctor is healthy.
Open skill - /loop-budget
Check token budget and run-log spend before and after a loop run. Enforces early exit when over budget or when there is no actionable work.
Open skill - /loop-constraints
Read loop-constraints.md at the start of every run and enforce every rule. This skill runs BEFORE triage or any action skill. Constraints are binding.
Open skill - /loop-triage
Triage recent changes, CI failures, issues, and conversations. Produces a concise, actionable findings report suitable for a loop to consume. Writes structured output to a state file or Linear board.
Open skill - /loop-verifier
Independent verification agent for loop-produced changes. Finds reasons to reject. Runs tests. Confirms diff scope. Use after minimal-fix or any implementer sub-agent — never in the same role as the implementer.
Open skill