Loading...
Loading...
Found 36 Skills
Manage X07 project dependencies and lockfiles for reproducible builds (lock, publish). Designed for autonomous agents.
Audit and reduce JavaScript package dependency footprint across npm, pnpm, Yarn, and Bun projects. Use when asked to remove unused dependencies, deduplicate workspace dependency versions, lockfiles or node_modules, analyze direct dependencies' transitive lockfile closure, find low-risk upgrades that reduce dependency trees, inline trivial dependencies, or apply e18e dependency replacement recommendations.
Bump a pinned dependency (TransformerEngine, Megatron-LM, NRX, etc.), regenerate the lockfile, open a PR, and drive it to green by attaching a watchdog to the "CICD NeMo" workflow and quarantining failing functional tests as flaky until the run is green.
Ghost Security - Software Composition Analysis (SCA) scanner. Scans dependency lockfiles for known vulnerabilities, identifies CVEs, and generates findings with severity levels and remediation guidance. Use when the user asks about dependency vulnerabilities, vulnerable packages, CVE checks, security audits of dependencies, or wants to scan lockfiles like package-lock.json, yarn.lock, go.sum, or Gemfile.lock.
Manage project dependencies effectively. Use when adding, updating, or auditing dependencies. Covers version management, security scanning, and lockfiles.
Activate when reviewing or modifying dependency resolution, lockfile schema, package downloaders, signature/integrity checks, file integration cleanup, or anything that could expose APM to dependency confusion, typosquatting, malicious packages, or token leakage.
Reproduce registry-managed iii worker installs with iii.lock. Use when working on CI, teams, deployments, worker pinning, sync, frozen installs, verification, or config.yaml and lockfile consistency.
Python project setup, deps, and lockfiles with uv. Use when the user mentions uv, creating Python projects, managing dependencies, lockfiles, or pyproject.toml.
Use when a project has package manifests and lockfiles and you want to know about known-vulnerable, abandoned, or suspicious dependencies before launch, without running install scripts. It reads manifests and lockfiles, uses the ecosystem's audit tooling where safe, and proposes minimal, non-breaking upgrades. Do not use it to upgrade major versions automatically, run untrusted install scripts, or claim a project is free of vulnerabilities.
Generate an offline-first dependency overview across services in a Docker-compose monorepo. Reports image tags & pinning quality, Dockerfile base images, runtime hints (Node/Python via .nvmrc, .python-version, package.json engines, pyproject.toml), and lockfile presence. Use when you want a single report of "what am I running and where are my update surfaces?" — no network calls, no pulls.
Reduces JavaScript dependency footprint with pnpm while preserving lockfile, workspace layout, and dependency range style. Runs /check-npm first, then removes unused deps, dedupes versions, ranks transitive closure, and reports Keep/Replace/Remove triage. Use when cleaning up pnpm dependencies, reducing lockfile size, or shrinking node_modules in Grafana plugins; not for Go modules or full GitHub Actions workflow audits.
Modern Python development with uv, ruff, mypy, and pytest. Use when: - Writing or reviewing Python code - Setting up Python projects or pyproject.toml - Choosing dependency management (uv, poetry, pip) - Configuring linting, formatting, or type checking - Organizing Python packages Keywords: Python, pyproject.toml, uv, ruff, mypy, pytest, type hints, virtual environment, lockfile, package structure