Skills dependency-updater
📦
dependency-updater
v1.0.0 Content revision r1 High Risk ⚙️ External commands📁 Filesystem access🌐 Network access
Update Project Dependencies Safely
Dependency updates are slow and risky across different ecosystems. This skill detects project types, applies safe updates, and guides audits with language-specific commands.
Supports: Claude Codex Code(CC)
Stop for confirmation before installing.
Review the plan and obtain explicit user consent before changing files.
Install with my Agent
Copy this request to your Agent. It includes the canonical Skill page and manifest.
Agent request
Review the Skillstore skill "dependency-updater" from https://skillstore.io/skills/softaworks-dependency-updater.md and its manifest at https://skillstore.io/api/skills/softaworks-dependency-updater/manifest. Verify the artifact. Stop and obtain explicit user consent before installing or changing files.Your Agent should still show its plan and request any confirmation required by the security policy.
Agent-readable resources
Use these links when an AI agent, crawler, or script needs clean context instead of reading the full page.
Test it
Using "dependency-updater". Update dependencies in this Node.js app.
Expected outcome:
- Detected Node.js using package.json and npm.
- Applied safe minor and patch updates.
- Found two major updates and requested approval before changing them.
- Ran the package audit and reported remaining issues.
Using "dependency-updater". Diagnose my failing Python dependency install.
Expected outcome:
- Detected a Python project using requirements.txt.
- Checked installed packages and dependency conflicts.
- Suggested a clean virtual environment only after explaining file impacts.
Using "dependency-updater". Audit this monorepo for vulnerable dependencies.
Expected outcome:
- Detected multiple package ecosystems.
- Ran the relevant audit tools for each ecosystem.
- Grouped findings by severity and listed follow-up verification steps.
Security Audit
High Riskv4 • 7/7/2026 Open versioned report
Most Markdown backtick findings are false positives caused by code fences, tables, or documentation links. Real risks remain because the skill and helper scripts run local package managers, can fetch unpinned tools, and include emergency reset commands that delete dependency artifacts. No prompt injection text or data exfiltration intent was found.
4
Files scanned
833
Lines analyzed
20
Review items
0
False positives ignored
Confirmed security concerns (3)
High
Destructive Emergency Reset Commands
The instructions include rm-based resets for Node.js, Python, and Go dependency state. If an agent follows these during diagnosis without confirmation, it can delete lock files, virtual environments, and module checksum files.
The deletion commands are explicit in both the skill instructions and README. They are legitimate recovery steps, but the data-loss impact is clear if run automatically.
Medium
Dynamic Helper Command Execution
scripts/check-tool.sh accepts a tool name from its first argument and invokes that value with a version flag. Quoting reduces shell injection risk, but arbitrary local tool execution remains possible if the helper is called with untrusted input.
The script directly assigns TOOL_NAME from $1 and later uses it as the command name. The behavior is visible in one short helper file, but intended allowlisted usage lowers confidence from very high.
Medium
Unpinned Tool Installation Recommendations
The skill recommends global or one-time installation of dependency tools without version pinning. Fetching latest tool code during a dependency update workflow adds supply-chain risk.
The installation commands are plainly documented and several install latest versions from package ecosystems. No malicious registry or domain is shown, so the risk is supply-chain exposure rather than confirmed abuse.
Capability review items (20)
These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.
High
Ruby/shell backtick execution
```bash
This block includes rm-based reset commands that delete dependency directories, lock files, virtual environments, or module checksum files. Those commands can cause data loss if followed without explicit confirmation.
Medium
Unix shell invocation
#!/bin/bash
This is a Bash helper used by the skill, and the file later executes a tool name supplied as an argument. It is legitimate dependency tooling but still creates local command execution risk.
Medium
Unix shell invocation
#!/bin/bash
This Bash helper invokes taze with user-provided arguments, which can rewrite dependency files. It is intended behavior but confirms external command execution risk.
Medium
Ruby/shell backtick execution
```bash
This block instructs the agent to run local package-manager commands that can modify dependencies, install packages, or query dependency trees. That is legitimate for the skill but confirms external command execution risk.
Medium
Ruby/shell backtick execution
```bash
This block instructs the agent to run local package-manager commands that can modify dependencies, install packages, or query dependency trees. That is legitimate for the skill but confirms external command execution risk.
Medium
Ruby/shell backtick execution
```bash
This block instructs the agent to run local package-manager commands that can modify dependencies, install packages, or query dependency trees. That is legitimate for the skill but confirms external command execution risk.
Medium
Ruby/shell backtick execution
```bash
This block instructs the agent to run local package-manager commands that can modify dependencies, install packages, or query dependency trees. That is legitimate for the skill but confirms external command execution risk.
Medium
Ruby/shell backtick execution
```bash
This block instructs the agent to run local package-manager commands that can modify dependencies, install packages, or query dependency trees. That is legitimate for the skill but confirms external command execution risk.
Medium
Ruby/shell backtick execution
```bash
This block instructs the agent to run local package-manager commands that can modify dependencies, install packages, or query dependency trees. That is legitimate for the skill but confirms external command execution risk.
Medium
Ruby/shell backtick execution
```bash
This block instructs the agent to run local package-manager commands that can modify dependencies, install packages, or query dependency trees. That is legitimate for the skill but confirms external command execution risk.
Medium
Ruby/shell backtick execution
```
This diagnosis section recommends package manager repair or analysis commands such as audit fix, depcheck, or dedupe. These are legitimate dependency actions but can modify dependency state or rely on local command execution.
Medium
Ruby/shell backtick execution
| **Security Vuln** | `npm audit` shows issues | `npm audit fix` or manual update |
This diagnosis section recommends package manager repair or analysis commands such as audit fix, depcheck, or dedupe. These are legitimate dependency actions but can modify dependency state or rely on local command execution.
Medium
Ruby/shell backtick execution
| **Unused Deps** | Bloated bundle | Run `depcheck` (Node) or equivalent |
This diagnosis section recommends package manager repair or analysis commands such as audit fix, depcheck, or dedupe. These are legitimate dependency actions but can modify dependency state or rely on local command execution.
Medium
Ruby/shell backtick execution
| **Duplicate Deps** | Multiple versions installed | Run `npm dedupe` or equivalent |
This diagnosis section recommends package manager repair or analysis commands such as audit fix, depcheck, or dedupe. These are legitimate dependency actions but can modify dependency state or rely on local command execution.
Medium
Ruby/shell backtick execution
```bash
This block instructs the agent to run ecosystem audit tools across multiple languages. Most are read-only, but they are still external commands in the user project.
Medium
Ruby/shell backtick execution
```bash
This block recommends global installation and npx execution of taze, which can fetch and run external package code. It is relevant dependency tooling but carries unpinned supply-chain risk.
Medium
Ruby/shell backtick execution
```bash
This block instructs the agent to run local package-manager commands that can modify dependencies, install packages, or query dependency trees. That is legitimate for the skill but confirms external command execution risk.
Medium
Ruby/shell backtick execution
```bash
This block runs package-manager diagnostics against the local dependency tree. These are lower-impact commands, but they still confirm external command execution in the user project.
Medium
Ruby/shell backtick execution
```bash
This block runs package-manager diagnostics against the local dependency tree. These are lower-impact commands, but they still confirm external command execution in the user project.
Medium
Ruby/shell backtick execution
```bash
This block instructs the agent to run local package-manager commands that can modify dependencies, install packages, or query dependency trees. That is legitimate for the skill but confirms external command execution risk.
Risk Factors
⚙️ External commands (74)
scripts/check-tool.sh:1 scripts/run-taze.sh:1 SKILL.md:17-19 SKILL.md:19-41 SKILL.md:41 SKILL.md:42 SKILL.md:43 SKILL.md:44 SKILL.md:45 SKILL.md:46 SKILL.md:47 SKILL.md:55 SKILL.md:56 SKILL.md:57 SKILL.md:58 SKILL.md:64-96 SKILL.md:96-104 SKILL.md:104-123 SKILL.md:123-127 SKILL.md:127-140 SKILL.md:140-144 SKILL.md:144-156 SKILL.md:156-160 SKILL.md:160-169 SKILL.md:169-173 SKILL.md:173-185 SKILL.md:185-189 SKILL.md:189-199 SKILL.md:199-203 SKILL.md:203-212 SKILL.md:212-226 SKILL.md:226 SKILL.md:227-228 SKILL.md:228-232 SKILL.md:232-247 SKILL.md:247-255 SKILL.md:255-275 SKILL.md:275-321 SKILL.md:321-322 SKILL.md:322-323 SKILL.md:323-324 SKILL.md:324-325 SKILL.md:325-326 SKILL.md:326-327 SKILL.md:327-328 SKILL.md:328-329 SKILL.md:329-330 SKILL.md:330-344 SKILL.md:344-350 SKILL.md:350-354 SKILL.md:354-370 SKILL.md:370-378 SKILL.md:378-379 SKILL.md:379-388 SKILL.md:388-394 SKILL.md:394-400 SKILL.md:400 SKILL.md:401 SKILL.md:402 SKILL.md:403 SKILL.md:404-408 SKILL.md:408-416 SKILL.md:416-426 SKILL.md:426-430 SKILL.md:430-433 SKILL.md:433-440 SKILL.md:440-443 SKILL.md:443-449 SKILL.md:449-454 SKILL.md:454-457 SKILL.md:457-460 SKILL.md:460-468 SKILL.md:468-478 SKILL.md:478-479
📁 Filesystem access (3)
🌐 Network access (5)
Audited by: codex View Audit History →
Share & cite this report
Share the versioned assessment report, neutral badge, embed card, and citations. Skillstore reports evidence without deciding whether this Skill is safe.
Copy report link
https://skillstore.io/skills/softaworks-dependency-updater/audits/4?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_reportMarkdown badge
[](https://skillstore.io/skills/softaworks-dependency-updater?utm_source=security_passport_badge)HTML badge
<a href="https://skillstore.io/skills/softaworks-dependency-updater?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/softaworks-dependency-updater/security.svg" alt="Skillstore security assessment" loading="lazy"></a>Embed card
<iframe src="https://skillstore.io/embed/skills/softaworks-dependency-updater.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>Academic citations (APA · BibTeX · CFF)
APA citation
softaworks. (2026). dependency-updater security audit report (audit version 4) [Author version 1.0.0]. Skillstore. https://skillstore.io/skills/softaworks-dependency-updater/audits/4BibTeX citation
@techreport{softaworks-softaworks-dependency-updater-2026,
author = {softaworks},
title = {dependency-updater security audit report (audit version 4)},
institution = {Skillstore},
year = {2026},
number = {4},
url = {https://skillstore.io/skills/softaworks-dependency-updater/audits/4},
note = {Author version 1.0.0}
}CITATION.cff
cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "dependency-updater security audit report (audit version 4)"
version: "1.0.0"
type: report
authors:
- name: "softaworks"
date-released: "2026-07-07"
url: "https://skillstore.io/skills/softaworks-dependency-updater/audits/4"
identifiers:
- type: other
value: "skillstore:softaworks-dependency-updater:audit:4"
description: "Skillstore immutable audit report identifier"
Compare variants
2 installable variantsEach author remains a separate installable skill. The recommended variant is ranked by Skillstore evidence.
Why this variant is first
Highest Skillstore Score
Author / source Skillstore Score Evidence Confidence Skillstore usage Updated
CuriousLearner Recommended
curiouslearner-dependency-updater
Skillstore Score 78
Evidence Confidence High
Skillstore usage 10
Updated
2026-08-21
softaworks Current
softaworks-dependency-updater
Skillstore Score 38
Evidence Confidence Medium
Skillstore usage 10
Updated
2026-08-21
Skillstore Score
Why this score Evidence Confidence: Medium 59
Architecture
100
Maintainability
85
Content
70
Community
83
Spec Compliance
What You Can Build
Routine Application Maintenance
Keep project dependencies current while separating safe patch updates from risky major upgrades.
Maintenance Pull Request Preparation
Prepare dependency update branches with changed files, audit output, and a clear verification checklist.
Dependency Vulnerability Triage
Run ecosystem audit tools and prioritize vulnerable dependencies by severity and remediation path.
Try These Prompts
Check My Project
Detect the project type in this repository and list outdated dependencies. Do not change files yet.
Apply Safe Updates
Update only patch and minor dependencies, skip pinned versions, then summarize changed files and versions.
Review Major Updates
Scan for major dependency updates, explain likely breaking changes, and ask me about each package before editing.
Audit Multi-Ecosystem Repository
Detect each package ecosystem in this monorepo, run the relevant audit tools, apply approved fixes, and produce a verification checklist.
Best Practices
- Commit lock files before and after dependency changes.
- Review changelogs and migration notes before approving major updates.
- Run tests and security audits after every update batch.
Avoid
- Auto-approving every major update without review.
- Deleting lock files without understanding the recovery plan.
- Ignoring audit findings after dependency updates.
Frequently Asked Questions
Does this skill support every programming language?
It supports the listed ecosystems through their package files and local package manager tools.
Will it automatically apply major updates?
No. The workflow prompts for major updates because they can include breaking changes.
Can it run security audits?
Yes. It uses ecosystem audit tools such as npm audit, pip-audit, govulncheck, cargo audit, and bundle audit.
Does it install required tools automatically?
It documents install commands and checks prerequisites, but tool installation depends on the agent and user approval policy.
What files can change during updates?
Dependency manifests and lock files can change when write-mode update commands or install commands run.
Is it safe for production repositories?
Use it on a branch, review major updates, commit lock files, and run tests before merging changes.
Developer Details
Author
softaworksLicense
MIT
Author version
v1.0.0
Skillstore revision
r1
Ref
f93e9bb0daca99badb6a7e574b97737155d57cb3
Maintenance freshness
7/18/2026
Usage
8 downloads · 203 views
File structure