serpro69/dependency-handling
klaude-plugin/skills/dependency-handling/SKILL.md
TRIGGER when: adding or upgrading any dependency — library, SDK, framework, API, IaC API version (K8s/Terraform/Helm), CRD, or container image. Use BEFORE writing the call. Forces context7/capy lookup instead of guessing.
$ install --global
skillsauthnpx skillsauth add serpro69/claude-starter-kit dependency-handlingInstall this skill globally with one command. Works with Claude Code, Cursor, and Windsurf.
Security Scan Results
3 of 9 scanners reported clean
Some scanners were skipped, did not run, or reported a non-clean status. Review each row below.
3
Scanners Passed
9
Scanners in report
Clean
TrivyContainer and dependency vulnerability scanner
95%
Clean
SemgrepStatic code analysis for vulnerabilities
95%
Clean
mcp-scan (Snyk)Model Context Protocol security validation
95%
Skipped
Snyk (dep)Open source security scanning
50%
Skipped
Socket.devSupply chain security analysis
50%
Skipped
VirusTotalMulti-engine malware detection
50%
Skipped
CrowdStrikeAdvanced threat intelligence
50%
Skipped
OSV-ScannerOpen Source Vulnerability database check
50%
Skipped
OWASP Dep-Check
50%
Last scanned: Apr 29, 2026, 9:43 AM62.5s2 files scanned
SKILL.md
- name:
- dependency-handling
- description:
- |
- TRIGGER when:
- adding or upgrading any dependency — library, SDK, framework, API, IaC API version (K8s/Terraform/Helm), CRD, or container image. Use BEFORE writing the call. Forces context7/capy lookup instead of guessing.
Dependency & External API Handling
Conventions
Read capy knowledge base conventions at shared-capy-knowledge-protocol.md.
Workflow
Mandatory order — lookup before usage. Do not write, modify, or recommend any call, import, config key, or version specifier involving the dependency until you have completed the lookup cascade below. Guessing a signature or API version and fixing it after the fact is the failure mode this skill exists to prevent.
- Extract the dependency identity. From the calling context, identify the dependency name, the version constraint (declared or inferred), and the specific API surface being used (function, config key, API version, image tag). This is the minimal scope — enough to drive the lookup, not enough to guess the answer.
- Capy search. Search
kk:lang-idiomsandkk:project-conventionsfor previously indexed knowledge about this dependency. - Context7 lookup. Use the context7 MCP to fetch documentation. The doc version MUST match the declared dependency version.
- Web fallback. Only if context7 has no coverage.
- Apply. With verified knowledge now loaded, write or recommend the call, import, or config.
Rules
- Prefer the latest stable version when introducing a new dependency. Pin deliberately; don't inherit a stale version by copy-paste.
- Never assume how an external dependency behaves. If you are not 100% sure of the signature, config, or semantics, look it up. Guessing is the failure mode this skill exists to prevent.
- Capy search first. Before hitting external docs, search
kk:lang-idiomsandkk:project-conventionsfor previously indexed knowledge about the dependency. - Context7 second. Use the context7 MCP to fetch documentation for libraries, SDKs, APIs, and frameworks.
- IMPORTANT: the doc version MUST match the declared dependency version. A right answer against the wrong version is a wrong answer.
- Only fall back to web search if context7 has no coverage.
- Index what you learn. If context7 or web search yields a best-practice nugget that isn't obvious from the docs themselves, index it as
kk:lang-idiomsso the next agent doesn't pay the lookup cost again.
IaC and config artifacts
The cascade rule (capy-first, context7-second, web-last) applies uniformly to all dependency categories — libraries, SDKs, frameworks, APIs, IaC API versions, CRDs, Helm charts, and container images. Per-domain lookup targets (which context7 library to query, which local command to run, which registry to consult) live in each profile's overview.md under a "Looking up dependencies" heading. When the k8s profile is active, consult ${CLAUDE_PLUGIN_ROOT}/profiles/k8s/overview.md under the ## Looking up Kubernetes dependencies heading for Kubernetes API versions, third-party CRDs, Helm chart versions, and container image targets.
Related Skills
serpro69/test
development
VerifiedTrustedCommunity
Guidelines describing how to test the code. Use whenever writing new or updating existing code, for example after implementing a new feature or fixing a bug.
138SKILL.mdUpdated May 7, 2026
serpro69/review-spec
development
VerifiedTrustedCommunity
Use after implementing tasks or mid-feature to verify code matches design docs and ensure they are in sync. Detects spec deviations, missing implementations, doc inconsistencies, and outdated docs in design and implementation documentation.
138SKILL.mdUpdated May 7, 2026
serpro69/review-design
testing
VerifiedTrustedCommunity
Review design and implementation docs produced by design. Evaluates document quality, internal consistency, and technical soundness. Use after design completes and before starting implement.
138SKILL.mdUpdated May 7, 2026
serpro69/merge-docs
testing
VerifiedTrustedCommunity
Compare and merge two design docs for the same feature into a single source of truth. Use when you have competing or complementary design/implementation docs (e.g. from separate design runs) that need reconciling into one unified document.
138SKILL.mdUpdated May 7, 2026