review-dependencies
This skill helps you scan and assess your project's dependencies for updates and security issues while keeping your codebase untouched. It's part of Turbo, a modular framework designed to streamline agentic development workflows with Claude Code.
review-dependencies scans your project's dependencies to identify security vulnerabilities (CVEs) in current dependency versions without making any changes to your codebase. The skill detects which package managers are in use across your project and generates a comprehensive assessment of potential security issues, allowing you to review threats before taking action.
AI-generated summary based on this skill's SKILL.md
Decision gist · record as of 2026-07-27
review-dependencies scans your project's dependencies to identify security vulnerabilities (CVEs) in current dependency versions without making any changes to your codebase. The skill detects which package managers are in use across your project and generates a comprehensive assessment of potential security issues, allowing you to review threats before taking action.
Use it when
- review-dependencies identifies outdated or vulnerable dependencies and categorizes available updates by severity—major, minor.
- Yes, review-dependencies is designed to identify outdated or vulnerable dependencies without making any changes to your codebase.
Verify before relying
Read SKILL.md below before installing (1 file). Open directory: indexed for reading, not audited.
Install
tobihagemann/turbo/review-dependencies · repository language: Shell
Open directory. Skills are indexed for reading, not audited. Review a skill's body before installing it.
Frequently asked questions
AI-generated answers based on this skill's SKILL.md and metadata
How can review-dependencies check my dependencies for vulnerabilities?
review-dependencies scans your project's dependencies to identify security vulnerabilities (CVEs) in current dependency versions without making any changes to your codebase. The skill detects which package managers are in use across your project and generates a comprehensive assessment of potential security issues, allowing you to review threats before taking action.
What does review-dependencies report about outdated packages?
review-dependencies identifies outdated or vulnerable dependencies and categorizes available updates by severity—major, minor, and patch versions. It provides a summary report of your dependency health along with update recommendations, helping you prioritize which packages need attention based on the type and importance of each update.
Can review-dependencies scan for outdated packages without modifying my project?
Yes, review-dependencies is designed to identify outdated or vulnerable dependencies without making any changes to your codebase. It performs a read-only audit of your packages, allowing you to review findings and plan updates on your own schedule as part of Turbo's modular framework for agentic development workflows.
Which package managers does review-dependencies support?
review-dependencies detects which package managers are in use across your project, enabling it to work with multiple dependency management systems. This multi-manager support ensures comprehensive scanning regardless of whether your project uses npm, yarn, pnpm, or other package managers.
What kind of summary does review-dependencies provide about dependency health?
review-dependencies generates a summary report that assesses your overall dependency health and provides actionable update recommendations. The report categorizes vulnerabilities and updates by severity, giving you a clear picture of which packages need attention and helping you make informed decisions about dependency maintenance.
SKILL.md
Rendered from the published skill. Quoted content, verbatim.
Review Dependencies
Detect package managers and discover outdated or vulnerable dependencies. Analysis only. Does not upgrade.
Step 1: Detect Package Managers
Identify which package managers are in use by searching for config files:
| Config file | Package manager | Lockfile | Ecosystem |
|---|---|---|---|
package.json |
npm / yarn / pnpm | package-lock.json / yarn.lock / pnpm-lock.yaml |
Node.js |
Package.swift, *.xcodeproj |
Swift Package Manager | Package.resolved |
Swift |
pyproject.toml, requirements.txt, setup.py |
pip / poetry / uv | poetry.lock, uv.lock |
Python |
Cargo.toml |
cargo | Cargo.lock |
Rust |
go.mod |
Go modules | go.sum |
Go |
Gemfile |
Bundler | Gemfile.lock |
Ruby |
pom.xml |
Maven | — | Java |
build.gradle, build.gradle.kts |
Gradle | gradle.lockfile |
Java/Kotlin |
(truncated - see the full file via the links below)
File tree — 1 file
claude/skills/review-dependencies/SKILL.md
Let your AI agent find skills like this
Example. Real query, live index.
You found this page by searching. An agent finds it by wishing: SkillFed indexes 56,283 agent skills by what they can do, searchable in plain language.
wish › “Identify outdated or vulnerable dependencies without making changes”
Give your agent the search over MCP, or paste the wish link into any chat. No install? Search from any chat →
Related skills
This skill automates dependency management across multiple package ecosystems, helping you keep npm, pip, cargo, and maven packages current while minimizing breaking changes. It integrates with AI agents to analyze version compatibility, flag security updates, and execute safe upgrades across your entire development stack.
dependency-updater automates the process of keeping your project dependencies current while maintaining stability and security. This skill integrates with AI coding agents to intelligently manage updates, applying protective measures to prevent breaking changes and ensure your codebase remains compatible.
This skill automates the process of updating your project's dependencies while maintaining stability and compatibility. It handles multiple programming languages and frameworks, reducing the manual work required to keep packages current and secure.
npm-helper simplifies package installation and dependency management for your development workflow. Quickly resolve version conflicts, update packages, and maintain clean project dependencies without manual configuration hassles.
This skill queries npm to compare your declared SDK versions against the latest published releases for Claude Code, Claude Agent SDK, and Codex SDK. It generates a status table showing which packages are current or outdated, then analyzes the version gap and release notes for each outdated package to help you assess update risk before installing.
Audit your REST API design against best practices for HTTP verb selection, versioning strategies, and status code correctness. Catches common mistakes like wrong HTTP methods, missing API versions, entity leaks, and improper error handling that break client compatibility.
More skills absolute-upgrade (MIT) · update-deps (MIT) · dependency-management (MIT)