skill
dependency-evolution-audit
Find actionable dependency migration debt without generating routine update noise.
Set up
Skills are installed by placing their folder where your agent loads skills.
The download comes from github.com/KashapovK/dependency-evolution-audit itself, not from our server, so what you get is exactly what its author published.
Install instructions come from the README
README
synced Oct 31, 2026Dependency Evolution Audit
Track migrations, not version numbers.
Dependency Evolution Audit is a signal-first dependency health check for AI coding agents. It compares resolved repository versions, current upstream changes, actual code usage, and existing tracker work before recommending or creating technical-debt issues.
The problem
Package freshness and technical debt are not the same thing. A long list of newer releases can hide the few changes that actually matter:
- an API used by the repository is deprecated or removed;
- a framework default changes on the practical upgrade path;
- a runtime or dependency approaches end of support;
- two dependencies become incompatible;
- an upstream migration is already accumulating architectural cost.
Dependency Evolution Audit filters out routine update noise and keeps only repository-specific, evidenced, novel, and actionable migration work.
Quick start
Install every skill in the repository:
npx skills add KashapovK/dependency-evolution-audit
Install only dependency-evolution-audit:
npx skills add KashapovK/dependency-evolution-audit --skill dependency-evolution-audit
Try it without installing:
npx skills use KashapovK/dependency-evolution-audit@dependency-evolution-audit
Update a project installation:
npx skills update dependency-evolution-audit -p -y
The signal gate
A finding becomes actionable only when all five conditions pass:
| Condition | Required proof |
|---|---|
EVIDENCE | Authoritative upstream material supports the change. |
APPLICABILITY | The repository uses the affected dependency, API, or behavior. |
MATERIALITY | Deferral creates meaningful cost, risk, incompatibility, or maintenance burden. |
ACTIONABILITY | A maintainer can act on a defined migration boundary. |
NOVELTY | The work is not already tracked or resolved. |
An ordinary patch release, an unrelated feature, or semver distance alone does not pass the gate. Creating zero issues is a successful audit outcome.
Operating modes
| Mode | Output | Side effects |
|---|---|---|
AUDIT_ONLY | Findings, checked noise, existing work, and a conclusion | None; this is the default |
ISSUE_PREPARATION | Ready-to-publish drafts for NEW findings; blocked candidate summaries otherwise | None |
ISSUE_WRITE | A specifically authorized tracker operation | Requires an exact operation, target, and fresh duplicate check |
Creation, editing, commenting, labeling, assigning, closing, and reopening are separate permissions. Scheduled execution uses the same modes. Scheduling by itself does not authorize tracker writes, and repeated runs must be idempotent.
How it works
- Establish manifests, lockfiles, resolved versions, runtimes, and workspace scope.
- Triage high-impact dependencies before lower-impact utilities.
- Verify only material upstream changes using current authoritative evidence.
- Search actual repository usage only for candidates with a meaningful upstream signal.
- Check open and closed tracker work before classifying a finding as new.
- Group related changes into coherent migration boundaries and prioritize them by impact.
The skill distinguishes manifest constraints from lockfile-resolved versions, stable releases from prereleases, and declared dependencies from affected usage. It does not install packages or modify repository code unless that work is separately requested.
What it returns
The default report includes the audited scope and date, actionable findings with direct evidence, candidates rejected by the signal gate when useful, already tracked or resolved work, and a concise conclusion. An actionable finding must have duplicate status NEW.
When tracker access is unavailable, the skill preserves the candidate as DUPLICATE_CHECK_INCOMPLETE under Needs verification. It does not call the candidate actionable, produce a publish-ready issue, or perform a tracker mutation until novelty is verified.
Issue drafts describe the current repository state, the relevant upstream change, why it matters here, the migration boundary, and a small set of verifiable acceptance criteria. They use migration statements instead of generic “update to latest” titles.
When it stays out
The skill skips straightforward requested package updates, one-off upstream questions with no repository applicability, purely local implementation work, and broad vulnerability audits that do not ask for dependency-migration analysis.
Privacy and security
Treat issue content as public. Never publish credentials, tokens, private URLs, internal hostnames, local machine paths, private code, personal data, or proprietary configuration. Send only the minimum public package or product context needed to external documentation and search services. See the security policy.
Development
Validate the skill with the repository's pinned Agent Skills reference validator:
skills-ref validate ./skills/dependency-evolution-audit
The CI workflow also validates the plugin manifest, release-version consistency, whitespace, and accidental secret exposure.
Behavioral routing and quality cases are documented in tests/activation-cases.md.