Dep Graph

Analyze and visualize project dependency trees from manifest files. Supports Node.js (package.json), Python (requirements.txt, pyproject.toml), Go (go.mod),...

Security Scan

The skill is internally consistent: it is an instruction-only dependency tree parser that only reads local manifest files and does not request credentials, install code, or make network calls.

Purpose & Capability

Name/description match the implementation: the script parses common manifest files (package.json, requirements.txt, pyproject.toml, go.mod, Cargo.toml, Gemfile, composer.json) and formats a tree or JSON. It does not request unrelated permissions or environment variables.

Instruction Scope

SKILL.md instructs running the included script against a project directory and using flags for JSON/summary/formatting. The script only reads files in the target directory (manifest files) and prints output; there are no instructions to read other system files, call external endpoints, or exfiltrate data.

Install Mechanism

No install spec is provided (instruction-only). The script uses only the Python standard library as claimed. Nothing is downloaded or written to disk by an installer.

Credentials

The skill declares no required environment variables, credentials, or config paths and the code does not reference credentials or external services. Requested access is minimal and appropriate for the described task.

Persistence & Privilege

always is false and the skill is user-invocable. It does not request permanent presence or attempt to modify other skills or global agent settings. Autonomous invocation is allowed (platform default) but is not combined with other concerning privileges.

Assessment

This skill is a small, local dependency manifest parser and appears coherent with its description. If you install it, note it will run the included Python script with the permissions of the agent and will read files in whatever project directory you point it at. If you want extra safety, inspect the script (scripts/dep_graph.py) yourself and run it in a controlled environment before allowing the agent to run it against sensitive directories.

Parse and display project dependency trees from manifest files. Auto-detects project type.

Quick Start

# Analyze current project
python3 scripts/dep_graph.py

# Analyze specific directory
python3 scripts/dep_graph.py /path/to/project

# JSON output
python3 scripts/dep_graph.py --json

# Summary only (just counts)
python3 scripts/dep_graph.py --summary

# Force project type
python3 scripts/dep_graph.py --type node

# Hide version constraints
python3 scripts/dep_graph.py --no-versions

Supported Project Types

Type	Manifest File	Groups
Node.js	package.json	production, dev, peer
Python	requirements.txt	production
Python	pyproject.toml	production
Go	go.mod	production, indirect
Rust	Cargo.toml	production, dev
Ruby	Gemfile	production, dev
PHP	composer.json	production, dev

Auto-detects multiple manifest files in the same project and reports all.

Output

Tree view shows dependencies grouped by type (production/dev/peer) with version constraints. Use --json for programmatic processing or --summary for quick counts.

Dependencies

• Python 3.8+ (stdlib only, no pip packages needed)