SavigeSystemZ/dependency-review
.cursor/skills/dependency-review/SKILL.md
Review dependency changes for security, license compliance, size impact, and necessity
testing
Updated Apr 16, 2026
$ install --global
skillsauthnpx skillsauth add SavigeSystemZ/Orignym dependency-reviewInstall this skill globally with one command. Works with Claude Code, Cursor, and Windsurf.
Security Scan Results
3 of 9 scanners reported clean
Some scanners were skipped, did not run, or reported a non-clean status. Review each row below.
3
Scanners Passed
9
Scanners in report
Clean
TrivyContainer and dependency vulnerability scanner
95%
Clean
SemgrepStatic code analysis for vulnerabilities
95%
Clean
mcp-scan (Snyk)Model Context Protocol security validation
95%
Skipped
Snyk (dep)Open source security scanning
50%
Skipped
Socket.devSupply chain security analysis
50%
Skipped
VirusTotalMulti-engine malware detection
50%
Skipped
CrowdStrikeAdvanced threat intelligence
50%
Skipped
OSV-ScannerOpen Source Vulnerability database check
50%
Skipped
OWASP Dep-Check
50%
Last scanned: Apr 16, 2026, 5:18 PM47.6s1 file scanned
SKILL.md
- name:
- dependency-review
- description:
- Review dependency changes for security, license compliance, size impact, and necessity
Dependency Review Skill
Authority
AGENTS.md_system/DEPENDENCY_GOVERNANCE.md_system/review-playbooks/DEPENDENCY_REVIEW_PLAYBOOK.md_system/PROJECT_PROFILE.md
Steps
- Read
_system/DEPENDENCY_GOVERNANCE.mdand the dependency review playbook. - Identify new, updated, or removed dependencies from changed manifests and lockfiles.
- For each new dependency, evaluate:
- Necessity (can it be done with existing deps or stdlib?)
- Maintenance health (last release, issue responsiveness)
- Security (known CVEs, supply chain history)
- License compatibility
- Bundle size and transitive dependency impact
- API stability and semver adherence
- For updated dependencies, review changelogs for breaking changes.
- Classify findings as must-fix, should-fix, or informational.
- Report using the playbook output format.
- Record unresolved items in
FIXME.md.
Related Skills
SavigeSystemZ/verify-gate
testing
VerifiedTrustedCommunity
Run verification before push, checkpoint, or claiming completion.
SKILL.mdUpdated Apr 16, 2026
SavigeSystemZ/release-readiness
testing
VerifiedTrustedCommunity
Evaluate whether work is truly ready for checkpoint, milestone completion, or release claims.
SKILL.mdUpdated Apr 16, 2026
SavigeSystemZ/prompt-pack-generator
documentation
VerifiedTrustedCommunity
Generate milestone prompt packs grounded in the repo's canonical docs.
SKILL.mdUpdated Apr 16, 2026
SavigeSystemZ/performance-review
testing
VerifiedTrustedCommunity
Audit changes for performance budget compliance and optimization opportunities
SKILL.mdUpdated Apr 16, 2026