review-dependencies
This skill helps you scan and assess your project's dependencies for updates and security issues while keeping your codebase untouched. It's part of Turbo, a modular framework designed to streamline agentic development workflows with Claude Code.
review-dependencies scans your project's dependencies to identify security vulnerabilities (CVEs) in current dependency versions without making any changes to your codebase. The skill detects which package managers are in use across your project and generates a comprehensive assessment of potential security issues, allowing you to review threats before taking action.
AI-generated summary based on this skill's SKILL.md
Install
tobihagemann/turbo/review-dependencies · repository language: Shell
git clone https://github.com/tobihagemann/turbo
cp -r turbo/claude/skills/review-dependencies ~/.claude/skills/review-dependenciesFrequently asked questions
AI-generated answers based on this skill's SKILL.md and metadata
How can review-dependencies check my dependencies for vulnerabilities?
review-dependencies scans your project's dependencies to identify security vulnerabilities (CVEs) in current dependency versions without making any changes to your codebase. The skill detects which package managers are in use across your project and generates a comprehensive assessment of potential security issues, allowing you to review threats before taking action.
What does review-dependencies report about outdated packages?
review-dependencies identifies outdated or vulnerable dependencies and categorizes available updates by severity—major, minor, and patch versions. It provides a summary report of your dependency health along with update recommendations, helping you prioritize which packages need attention based on the type and importance of each update.
Can review-dependencies scan for outdated packages without modifying my project?
Yes, review-dependencies is designed to identify outdated or vulnerable dependencies without making any changes to your codebase. It performs a read-only audit of your packages, allowing you to review findings and plan updates on your own schedule as part of Turbo's modular framework for agentic development workflows.
Which package managers does review-dependencies support?
review-dependencies detects which package managers are in use across your project, enabling it to work with multiple dependency management systems. This multi-manager support ensures comprehensive scanning regardless of whether your project uses npm, yarn, pnpm, or other package managers.
What kind of summary does review-dependencies provide about dependency health?
review-dependencies generates a summary report that assesses your overall dependency health and provides actionable update recommendations. The report categorizes vulnerabilities and updates by severity, giving you a clear picture of which packages need attention and helping you make informed decisions about dependency maintenance.
SKILL.md
rendered from the published skill — quoted content, verbatim
Review Dependencies
Detect package managers and discover outdated or vulnerable dependencies. Analysis only. Does not upgrade.
Step 1: Detect Package Managers
Identify which package managers are in use by searching for config files:
| Config file | Package manager | Lockfile | Ecosystem |
|---|---|---|---|
package.json |
npm / yarn / pnpm | package-lock.json / yarn.lock / pnpm-lock.yaml |
Node.js |
Package.swift, *.xcodeproj |
Swift Package Manager | Package.resolved |
Swift |
pyproject.toml, requirements.txt, setup.py |
pip / poetry / uv | poetry.lock, uv.lock |
Python |
Cargo.toml |
cargo | Cargo.lock |
Rust |
go.mod |
Go modules | go.sum |
Go |
Gemfile |
Bundler | Gemfile.lock |
Ruby |
pom.xml |
Maven | — | Java |
build.gradle, build.gradle.kts |
Gradle | gradle.lockfile |
Java/Kotlin |
(truncated - see the full file via the links below)
Read as markdown · JSON record · Browse the source repository
File tree — 1 file
claude/skills/review-dependencies/SKILL.md