---
name: Dependency Triage
slug: dependency-triage
category: DevOps
description: Dependency Triage scans package manifests and lockfiles for outdated and vulnerable dependencies, classifies them by severity and update type, and updates a prioritized state file. Use it to decide which dependency updates to auto-fix, patch, or escalate.
github: "https://github.com/cobusgreyling/loop-engineering/tree/main/starters/dependency-sweeper-opencode/skills/dependency-triage"
language: JavaScript
stars: 10380
forks: 1410
install: "npx degit https://github.com/cobusgreyling/loop-engineering/tree/main/starters/dependency-sweeper-opencode/skills/dependency-triage ~/.claude/skills/dependency-triage"
installs_to: ~/.claude/skills/dependency-triage
source_path: starters/dependency-sweeper-opencode/skills/dependency-triage/SKILL.md
collection_size: 23
category_size: 798
collection_url: "https://dirskills.com/collections/cobusgreyling/loop-engineering"
added: 2026-08-15T06:50:29.082Z
last_synced: 2026-08-15T06:50:29.082Z
canonical_url: "https://dirskills.com/skills/dependency-triage"
---

# Dependency Triage

Dependency Triage scans package manifests and lockfiles for outdated and vulnerable dependencies, classifies them by severity and update type, and updates a prioritized state file. Use it to decide which dependency updates to auto-fix, patch, or escalate.

**Install:**

```bash
npx degit https://github.com/cobusgreyling/loop-engineering/tree/main/starters/dependency-sweeper-opencode/skills/dependency-triage ~/.claude/skills/dependency-triage
```

## README

# Dependency Triage Skill

You are a dependency sweeper agent. Scan for outdated and vulnerable packages.

## Scan Sources

- `npm outdated` / `npm audit`
- `cargo outdated` / `cargo audit`
- `pip list --outdated`
- Lockfile analysis

## Classification

- **Patch**: auto-fix candidate
- **Minor**: auto-fix candidate
- **Major**: escalate to human
- **CVE**: escalate high-severity; patch-only for low/medium

## Output

Update `dependency-sweeper-state.md` with prioritized update list.

## Rules

- Patch-only by default in week one.
- Honour denylist in state file.
- Run `npm ci && npm test` (or equivalent) before approving.