Agent Skills
› NeverSight/learn-skills.dev
› depsdotdev
depsdotdev
GitHub利用 deps.dev API 获取开源包的元数据、版本、依赖图及安全公告。适用于包查询、依赖分析、purl 查找及漏洞情报检索等场景。
Trigger Scenarios
用户提及 deps.dev 或 Open Source Insights
需要查询软件包或版本的详细信息
请求依赖关系图谱或依赖智能分析
进行 purl 查找或安全公告查询
在代码中集成 deps.dev API
Install
npx skills add NeverSight/learn-skills.dev --skill depsdotdev -g -y
SKILL.md
Frontmatter
{
"name": "depsdotdev",
"source": "https:\/\/docs.deps.dev\/api\/",
"license": "MIT",
"version": "1.0.0",
"description": "Use the deps.dev API, also called Open Source Insights, to fetch package metadata, versions, dependency graphs, advisories, project mappings, and hash lookups. Use this skill when the user mentions deps.dev, Open Source Insights, package or version lookups, dependency intelligence, resolved dependency graphs, purl lookups, advisory queries, or integrating the deps.dev API into code."
}
deps.dev API
Use this skill to map package coordinates (system/name/version) to high-signal dependency intelligence from Open Source Insights.
Start Here
- Prefer stable API base:
https://api.deps.dev/v3 - Use
v3alphaonly when you need purl and batch endpoints - Percent-encode all path/query values before sending requests
- Use canonical values returned in responses (
packageKey,versionKey,projectKey) for follow-up calls
Fast Routing
| If you need to... | Use | Read |
|---|---|---|
| List versions for a package | GetPackage |
references/endpoint-map.md |
| Inspect one version (licenses, advisories, links) | GetVersion |
references/endpoint-map.md |
| Get declared constraints | GetRequirements |
references/endpoint-map.md |
| Get resolved dependency graph | GetDependencies |
references/endpoint-map.md |
| Map project repo to package versions | GetProjectPackageVersions |
references/endpoint-map.md |
| Query by file hash or exact version key | Query |
references/endpoint-map.md |
| Avoid encoding mistakes | URL/purl rules | references/request-shapes-and-encoding.md |
| Handle limits and error cases | batch/query limits | references/limits-errors-and-reliability.md |
| Use purl/batch/dependents | v3alpha features |
references/v3alpha-extras.md |
Minimal Workflow
- Normalize user input into
{system, name, version?}. - Call
GetPackageif version is missing; preferisDefaultor newest published version. - Call
GetVersionfor license/advisory/provenance metadata. - Add
GetRequirementsandGetDependencieswhen user asks "declared" vs "resolved" dependency questions. - If input is a hash or purl, use
Queryorv3alphapurl endpoints.
Examples
- Curl patterns and jq snippets:
examples/curl-cheatsheet.md
External Docs
- API overview and versions: https://docs.deps.dev/api/
- Stable REST schema: https://docs.deps.dev/api/v3/
- Experimental REST schema: https://docs.deps.dev/api/v3alpha/
Version History
- e0220ca Current 2026-07-05 22:10
