deps-checklisted

# Purpose Audit dependency versions across all of the project's repositories (see `.claude/project.json` → `repos`), producing a structured report of outdated packages, security vulnerabilities, and cross-repo version mismatches. This skill scans and reports only; it does not modify lockfiles or upgrade packages. For acting on findings, hand off to the implementation agent with the report as input. Placeholders: `<mainApp>` = `project.json → mainApp`; `<device>` = `project.json → device` (the device/edge repo, if the project has one); `<infrastructure-repo>` = the project's infrastructure/chart repo(s). # When to use this skill - Trigger A -- Periodic dependency audit requested (e.g., monthly security review) - Trigger B -- Pre-release check to verify no known vulnerabilities ship - Trigger C -- Cross-repo version alignment check (e.g., ensuring shared TypeScript packages use the same version in the main app) - Trigger D -- After a CVE advisory, checking if the project's repos are affected # When NOT to use this skill - Anti-trigger A -- Upgrading packages or running `npm update` / `pip install --upgrade` (that is an implementation task, not an audit) - Anti-trigger B -- Deployment config template lint errors (use `deployment`) - Anti-trigger C -- Offline environment without network access (package registry queries will fail silently) - Anti-trigger D -- Repos without a lockfile (`package-lock.json` or `requirements.txt`) -- flag as incomplete scan rather than proceedin