← Back to Skills Marketplace
codekungfu

Deps Mgmt

by ClawKK · GitHub ↗ · v1.0.0 · MIT-0
cross-platform ✓ Security Clean
131
Downloads
0
Stars
0
Active Installs
1
Versions
Install in OpenClaw
/install deps-mgmt
Description
Deep dependency management workflow—inventory, upgrade policy, security patches, licensing, lockfiles, and supply-chain hygiene. Use when upgrading framework...
README (SKILL.md)

Dependencies

Dependencies are supply-chain surface area: versions affect security, reproducibility, and upgrade cost.

When to Offer This Workflow

Trigger conditions:

  • Dependabot noise; major version upgrades
  • CVE response or license audit
  • “Works on my machine” due to unpinned dependencies

Initial offer:

Use six stages: (1) inventory & risk, (2) policy & cadence, (3) lockfiles & reproducibility, (4) upgrades & testing, (5) security & licensing, (6) governance & tooling). Confirm ecosystem (npm, pip, Maven, Go modules, etc.).

Stage 1: Inventory & Risk

Goal: Direct vs transitive dependencies; flag critical packages (crypto, auth, parsing, serialization).

Exit condition: SBOM or export for top applications; list of critical deps.

Stage 2: Policy & Cadence

Goal: When to upgrade (time-based vs on-demand); SemVer rules for libraries vs applications.

Stage 3: Lockfiles & Reproducibility

Goal: Committed lockfiles for deployable apps; libraries test against a compatibility matrix instead of one frozen lock.

Stage 4: Upgrades & Testing

Goal: Prefer one major bump per PR when feasible; CI matrix on supported language/runtime versions.

Stage 5: Security & Licensing

Goal: SCA scanning; patch SLA by severity; license allowlist for compliance.

Stage 6: Governance & Tooling

Goal: Renovate/Bot policies; pin internal packages; document exceptions and overrides.

Final Review Checklist

  • Inventory and risk hotspots known
  • Upgrade cadence and semver policy documented
  • Lockfiles or matrix strategy per repo type
  • CI validates upgrades
  • SCA and license policy enforced

Tips for Effective Guidance

  • Transitive CVEs may need overrides—trace the dependency graph.
  • Pin CI images and toolchains, not only application dependencies.

Handling Deviations

  • Monorepos: shared versions with Nx/Bazel/etc.—coordinate breaking upgrades.
Usage Guidance
This skill is an advisory checklist and appears safe to install: it makes no network calls, installs, or secret requests in its instructions. Before using it in automated workflows, confirm what your agent will be permitted to do when you ask it to act on these recommendations (for example, whether the agent will be allowed to read repositories, run SCA tools, or modify CI). If you intend to run inventory or fixes, use explicit, audited tools and grant the agent least privilege (read-only repo access, scoped API tokens) and monitor any requests to expose credentials or external endpoints. Finally, remember this skill is high-level guidance — you'll still need concrete tooling (SBOM generators, SCA scanners, CI jobs) to perform the actual scans and upgrades.
Capability Analysis
Type: OpenClaw Skill Name: deps-mgmt Version: 1.0.0 The skill bundle provides a structured workflow for dependency management, covering inventory, security patching, and licensing. It contains no executable code or suspicious instructions, focusing entirely on guiding the agent through standard software supply-chain best practices in SKILL.md.
Capability Assessment
✓ Purpose & Capability
Name, description, and the SKILL.md all describe a dependency-management workflow (inventory, policy, lockfiles, upgrades, SCA, governance). The skill requests no binaries, env vars, installs, or config paths — which is coherent for a purely advisory workflow.
✓ Instruction Scope
SKILL.md contains process steps, checklists, and recommendations only; it does not instruct the agent to read files, call external services, or access credentials. The guidance is intentionally high-level and does not perform any I/O itself.
✓ Install Mechanism
No install spec or code files are present. As an instruction-only skill, nothing will be written to disk or downloaded during install.
✓ Credentials
The skill declares no required environment variables, credentials, or config paths — appropriate for a non-executing advisory workflow.
✓ Persistence & Privilege
always is false and model invocation is not disabled (default). The skill does not request persistent presence or elevated privileges.
How to Use
  1. Make sure OpenClaw is installed (local or Docker)
  2. Run the install command in chat: /install deps-mgmt
  3. After installation, invoke the skill by name or use /deps-mgmt
  4. Provide required inputs per the skill's parameter spec and get structured output
Version History
v1.0.0
Initial release of the deps-mgmt skill providing a structured workflow for deep dependency management. - Introduces a six-stage process covering inventory, policy, reproducibility, upgrades, security, and governance. - Includes clear trigger conditions to identify when to apply the workflow. - Offers defined goals and exit conditions for each workflow stage. - Provides a comprehensive final review checklist to ensure best practices. - Shares tips for effective dependency management and strategies for handling monorepo deviations.
Metadata
Slug deps-mgmt
Version 1.0.0
License MIT-0
All-time Installs 0
Active Installs 0
Total Versions 1
Frequently Asked Questions

What is Deps Mgmt?

Deep dependency management workflow—inventory, upgrade policy, security patches, licensing, lockfiles, and supply-chain hygiene. Use when upgrading framework... It is an AI Agent Skill for Claude Code / OpenClaw, with 131 downloads so far.

How do I install Deps Mgmt?

Run "/install deps-mgmt" in the OpenClaw or Claude Code chat to install it in one step — no extra setup required.

Is Deps Mgmt free?

Yes, Deps Mgmt is completely free, licensed under MIT-0. You can download, install and use it at no cost.

Which platforms does Deps Mgmt support?

Deps Mgmt is cross-platform and runs anywhere OpenClaw / Claude Code is available (cross-platform).

Who created Deps Mgmt?

It is built and maintained by ClawKK (@codekungfu); the current version is v1.0.0.

More Skills
self-improving agent
Captures learnings, errors, and corrections to enable continuous improvement. Use when: (1) A command or operation fails unexpectedly, (2) User corrects Clau...
⬇ 463283 · by pskoett
Skill Vetter
Security-first skill vetting for AI agents. Use before installing any skill from ClawdHub, GitHub, or other sources. Checks for red flags, permission scope, and suspicious patterns.
⬇ 259410 · by spclaudehome
Polymarket
Query Polymarket prediction markets. Check odds, find trending markets, search events, track price movements.
⬇ 232503 · by joelchance
Self-Improving + Proactive Agent
Self-reflection + Self-criticism + Self-learning + Self-organizing memory. Agent evaluates its own work, catches mistakes, and improves permanently. Use when...
⬇ 200423 · by ivangdavila
Github
Interact with GitHub using the `gh` CLI. Use `gh issue`, `gh pr`, `gh run`, and `gh api` for issues, PRs, CI runs, and advanced queries.
⬇ 191115 · by steipete
ontology
Typed knowledge graph for structured agent memory and composable skills. Use when creating/querying entities (Person, Project, Task, Event, Document), linkin...
⬇ 190156 · by oswalpalash

💬 Comments