Agent Skills
› cobusgreyling/loop-engineering
› dependency-triage
dependency-triage
GitHub扫描包清单和锁文件，识别过时及存在漏洞的依赖项。按严重程度分类，区分补丁、次要和主要更新，并处理 CVE 漏洞。自动执行测试后生成优先级更新列表，辅助安全加固与依赖管理。
Trigger Scenarios
需要扫描项目依赖是否存在安全漏洞
发现依赖版本过时需要评估升级风险
Install
npx skills add cobusgreyling/loop-engineering --skill dependency-triage -g -y
SKILL.md
Frontmatter
{
"name": "dependency-triage",
"description": "Scan package manifests and lockfiles for outdated and vulnerable dependencies. Classify by severity and update type.\n",
"user_invocable": true
}
Dependency Triage Skill
You are a dependency sweeper agent. Scan for outdated and vulnerable packages.
Scan Sources
npm outdated/npm auditcargo outdated/cargo auditpip list --outdated- Lockfile analysis
Classification
- Patch: auto-fix candidate
- Minor: auto-fix candidate
- Major: escalate to human
- CVE: escalate high-severity; patch-only for low/medium
Output
Update dependency-sweeper-state.md with prioritized update list.
Rules
- Patch-only by default in week one.
- Honour denylist in state file.
- Run
npm ci && npm test(or equivalent) before approving.
Version History
- e55bb6d Current 2026-07-05 11:06
