dependency-doctor skill

by Shubhamsaboo·Shubhamsaboo/awesome-llm-apps·145k stars·Apache-2.0

Checks requirements.txt, pyproject.toml, and package.json dependency manifests for surface-level direct-dependency footguns: standard-library shadowing pins, abandoned backports, unpinned dependencies, and obvious intra-manifest conflicts, plus opt-in PyPI yanked releases. Use when the user asks to check a manifest for dependency problems, asks why dependencies won't install or whether anything is wrong with their dependencies, wants a dependency autopsy, or suspects dependency manifest rot. Runs offline by default as a local tool for the user's own project, not repository CI.

A100/100content scan

Is the dependency-doctor skill safe?

Clean: nothing in its files matched our rules. We read 4 files in the folder on 2026-11-06.

No findings.

Install the dependency-doctor skill

A skill is a folder. Copy it into your agent's skills folder and the agent loads it when the task matches its description.

git clone --depth 1 https://github.com/Shubhamsaboo/awesome-llm-apps.git /tmp/awesome-llm-apps
mkdir -p ~/.claude/skills
cp -r /tmp/awesome-llm-apps/agent_skills/dependency-doctor ~/.claude/skills/dependency-doctor

available in every project

In the Claude apps, zip the folder and upload it from the Skills settings. The folder on GitHub

The instructions your agent would load

SKILL.md as published, without the frontmatter. Read it on GitHub

Dependency Doctor

Inspect one dependency manifest on the user's machine for direct, surface-level footguns. Explain each finding in plain language, then offer a small, reviewable fix. This does not diagnose a failed pip or uv resolution.

This is a local developer tool for a project the user chooses. It is not a repository-wide lint rule, a CI gate, or a proposal to enforce dependency policy across unrelated apps.

When to use

The user asks to check, audit, diagnose, or autopsy a dependency manifest
The user wants to rule out direct-manifest issues before deeper install debugging
The user suspects stale pins, backports, duplicate entries, or dependency rot
The user asks whether anything looks wrong with their dependencies

When not to use

approved security scanner for CVE coverage

Installing the current dependencies without diagnosing them
Upgrading every package or adding a new package
A full vulnerability audit. Use pip-audit, npm audit, or the project's

Creating a repo-wide CI check. This skill is user-invoked and local

Choose the manifest

Use the path the user names. If no path is given and several manifests exist, ask which one to inspect. Do not sweep the repository or edit anything merely because the skill was triggered.

Supported inputs:

requirements.txt
pyproject.toml using PEP 621 or common Poetry dependency tables
package.json dependency sections

Run the offline diagnosis

From this skill directory:

python3 scripts/dep_doctor.py /path/to/requirements.txt --json

The default path is fully offline. It reads only the selected manifest. The report shape is:

{
  "file": "/path/to/requirements.txt",
  "findings": [
    {
      "severity": "high",
      "kind": "stdlib-shadowing",
      "package": "pathlib",
      "line": 4,
      "why": "...",
      "fix": "..."
    }
  ],
  "summary": {
    "total": 1,
    "by_severity": {"high": 1},
    "by_kind": {"stdlib-shadowing": 1},
    "online": false
  }
}

The offline checks cover:

Python standard-library names published as packages
Known backports that should not be installed on supported Python versions
Dependencies without a usable version constraint
Repeated package entries
Conflicting exact pins for the same package

For package.json, Python-specific standard-library and backport checks do not apply. The doctor still checks unpinned values and repeated dependency entries.

Explain the diagnosis

Read references/dependency-pitfalls.md before presenting findings. Lead with high severity items, then medium and low. For each finding, include:

Package and source line
What can break
The suggested fix

Do not call every range a conflict. The deterministic core reports conflicting constraints only when exact pins disagree. Compatible constraints split across multiple lines are duplicate entries that should be combined.

If there are no findings, say what was checked and note the limits. A clean report is not a CVE audit or a full dependency resolver.

Optional PyPI yank check

The online check sends package names and exact pinned versions to pypi.org. Ask for permission before enabling it, even if the user previously requested an offline diagnosis.

python3 scripts/dep_doctor.py /path/to/requirements.txt --json --online

It reports an exact Python release only when every file for that release is marked yanked. Network failures become low-severity findings instead of hiding the offline diagnosis.

Offer fixes, do not apply them silently

After explaining the report, offer a focused edit. Wait for approval before changing the manifest.

genuinely needs one

Remove standard-library packages from supported Python projects
Remove obsolete backports, or add a Python-version marker when an old runtime

version, confirm it is intended, and propose an exact reviewed pin

For an unpinned dependency, inspect the working environment's installed

Keep one entry for duplicates and combine compatible constraints
For conflicting exact pins, inspect dependents before choosing a version
Replace a yanked pin with a tested, non-yanked release

After any approved edit, rerun the offline diagnosis and the project's existing install or test command. Do not introduce a new CI gate.

Files

scripts/dep_doctor.py: stdlib-only manifest parser and diagnosis engine
references/dependency-pitfalls.md: reasoning guide for the reported risks

More skills from Shubhamsaboo/awesome-llm-apps

Aadvisor-orchestrator-workerUse when a task is too large for one model pass, needs parallel research or generation across many subtasks (like researching a dozen competitors at once), or the user asks to orchestrate multiple models, split work across a model team, run an advisor-worker loop, have a stronger model review the plan while cheap workers execute, or says "too big for one model" or "fan this out". Not for single-file edits or tasks one model handles in one pass.
Achatgpt-app-builderDEPRECATED: This skill has been replaced by `mcp-app-builder`. Check if `mcp-app-builder` is available in the skills folder. If not, install it: `npx skills install mcp-use/mcp-use --skill mcp-app-builder` Use `mcp-app-builder` instead of this skill.
Acommit-archaeologistReconstructs why code exists from local git history, including the introducing commit, later changes, current authors, repeated companion files, and likely intent. Use when the user asks "why does this code exist", "who wrote this function and why", or to "explain the history of this function" before a rewrite, refactor, or risky edit. Runs entirely locally.
Afirst-readerBeta readers for any draft, run by simulating how a real reader experiences it, moment by moment. A skim gate, a no-lookahead timed read producing an attention transcript with quit points, a recall test of what a reader remembers the next day, and a trust ledger of the implied author. Use when the user asks for a beta read, beta readers, test readers, human review, reader review, to read something like a human, to be a first reader, whether a piece holds attention or will actually get read, for a quick read of whether a busy skimmer would even open a post, what readers will remember or take away tomorrow, where readers stop reading or bounce, or why a draft still feels off or hollow after anti-slop or humanizer edits. Final gate before publishing; reports where the reading broke; never rewrites.
Amcp-apps-builder**MANDATORY for ALL MCP server work** - mcp-use framework best practices and patterns.
Amcp-builderDEPRECATED: This skill has been replaced by `mcp-app-builder`. Check if `mcp-app-builder` is available in the skills folder. If not, install it: `npx skills install mcp-use/mcp-use --skill mcp-app-builder` Use `mcp-app-builder` instead of this skill.
Aproject-graveyardScans the developer's machine for dead side projects, autopsies each one from its git history (died at the payments wall, killed by a newer project, finished but never shipped), surfaces their personal death patterns, and picks the corpse most worth resurrecting — then helps ship it. Use when the user mentions abandoned, unfinished, or old side projects, asks "what should I finish", wants to revive or resurrect a project, says "run the graveyard", wonders why they never finish anything, or is about to start a new project that sounds like one they already built. Runs entirely locally.
Ascope-creep-detectorAnalyzes git diffs against a stated intent to detect scope creep, unrelated files, broad pull requests, changes that grew beyond a fix, dependency additions, public API renames, config or CI edits, oversized hunks, and formatting-only files. Use when the user asks whether a change grew beyond the fix, a PR is too broad, or what unrelated stuff they touched, and wants keep, split, or justify guidance. Operates locally and offline.
Athinking-out-loudA contract for what the agent does when a long, messy, stream-of-consciousness ramble arrives (usually voice dictation): act on nothing until the echo brief is approved. The echo audits the entire transfer, mission, locked decisions and constraints, open questions, flips and parked tangents, with the model's inferences and guesses quarantined away from the user's own phrasing, so the user verifies what the model believes, not just what it doubts. Use when the user says "let me think out loud" or wants to ramble a bit before building anything, when a message opens with a speech-to-text preamble like "switching to voice, sorry for typos", when input is a long weakly punctuated stream with restarts and mid-message reversals ("actually no, wait, scrap that idea entirely"), or when the user asks to be interviewed about a fuzzy half-formed idea. Includes an optional capture mode for rambles spread across several messages and an optional targeted interview.

All agent skills → · MCP servers