{"enrichment":{"faq":[{"a":"dependency-management helps you establish secure dependency practices by integrating vulnerability scanning, version pinning strategies, and automated update workflows. The skill guides you through auditing your dependency tree for known security issues, deciding which third-party packages are safe to add, and implementing lockfile best practices to ensure reproducible builds across environments.","q":"How do I manage npm dependencies safely with dependency-management?"},{"a":"dependency-management supports both Dependabot and Renovate as automated dependency update solutions. Dependabot is GitHub-native and integrates directly with your repository, while Renovate offers more granular configuration options and multi-platform support. The skill helps you set up either tool based on your project's needs, including scheduling, grouping, and testing strategies for automated updates.","q":"What's the difference between Dependabot and Renovate for dependency-management workflows?"},{"a":"dependency-management includes supply chain security features to detect and prevent typosquatting and dependency confusion attacks. The skill analyzes package names for suspicious similarities, verifies package authenticity against registries, and flags unusual package metadata that might indicate malicious packages masquerading as legitimate dependencies.","q":"How can dependency-management help detect typosquatting attacks in packages?"},{"a":"dependency-management systematically addresses npm audit findings by categorizing vulnerabilities by severity and exploitability, recommending version upgrades or patches, and helping you understand when to use npm overrides and resolutions to resolve conflicts. The skill integrates with Claude Code to apply fixes automatically where safe, or guide manual remediation for complex dependency trees.","q":"What npm audit vulnerabilities fix strategies does dependency-management recommend?"},{"a":"dependency-management scans your entire dependency tree\u2014including transitive dependencies\u2014to identify licenses and flag compliance risks. The skill can generate a Software Bill of Materials (SBOM) documenting all dependencies and their licenses, helping you ensure your project meets organizational and legal requirements before deployment.","q":"How does dependency-management ensure license compliance across my dependency tree?"},{"a":"dependency-management recommends npm ci (clean install) for CI/CD pipelines because it installs exact versions from your lockfile, ensuring reproducible builds and preventing unexpected dependency changes. npm install is better for local development where you may want to update packages. The skill helps you configure lockfile management best practices and explains how version pinning with caret (^) and tilde (~) operators affects your supply chain security.","q":"When should I use npm ci versus npm install in CI/CD pipelines with dependency-management?"}],"shadow_tags":["supply-chain-security","version-strategy","vulnerability-scanning","license-compliance","update-automation","dependency-tree","package-registry","semver-management","sbom-generation","typosquatting-detection"],"summary_rewrite":"This skill helps you systematically review and remediate security vulnerabilities within your project's dependency tree. It integrates with Claude Code to scan for known issues, assess their impact, and recommend or apply fixes automatically."},"files":[{"bytes":12733,"path":".claude/skills/dependency-management/SKILL.md","sha256":"fd7bd1f211a2eecbd502e4370b989383dc3d8500b7408d22cf9401fff16682be","url":"https://skillfed.io/files/curiositech/some_claude_skills/dependency-management/e5c0c535/SKILL.md"}],"id":"curiositech/some_claude_skills/dependency-management","links":{"html":"https://skillfed.io/curiositech/some_claude_skills/dependency-management","md":"https://skillfed.io/curiositech/some_claude_skills/dependency-management.md","repo":"https://github.com/curiositech/some_claude_skills"},"meta":{"agents_supported":["claude-code"],"first_seen":"2026-07-28","forks":27,"language":"TypeScript","last_updated":"2026-07-14","license":"MIT","name":"dependency-management","publisher":"curiositech","stars":164},"relations":{"similar":[{"id":"vasilyu1983/AI-Agents-public/dev-dependency-management"},{"id":"rampstackco/claude-skills/dependency-management"},{"id":"secondsky/sap-skills/sap-dependency-security"},{"id":"Mathews-Tom/armory/dependency-audit"},{"id":"secondsky/claude-skills/dependency-upgrade"},{"id":"secondsky/sap-skills/dependency-upgrade"},{"id":"grafana/skills/audit-and-reduce-dependencies"},{"id":"Aradotso/security-skills/npm-security-best-practices"},{"id":"duthaho/claudekit/audit-dependencies"},{"id":"tartinerlabs/skills/deps"}]},"slug":{"owner":"curiositech","repo":"some_claude_skills","skill":"dependency-management"},"version":"e5c0c535"}