A comprehensive health examination tool for your dependency tree that evaluates risk beyond simple version checks.
Install & Download
1. ClawHub CLI
The fastest way to install a skill directly from the registry.
npx clawhub@latest install dependency-autopsy
2. Manual Installation
Copy the skill folder to one of these locations
~/.openclaw/skills/ <project>/skills/ Priority: Workspace > Local > Bundled
3. Prompt Installation
Copy this prompt to OpenClaw to install it automatically.
Help me install dependency-autopsy using Clawhub. If Clawhub is not installed, install it first (npm i -g clawhub).
Prefer to download?
Get the raw skill files in a ZIP archive.
What is Dependency Autopsy?
Dependency Autopsy is a sophisticated diagnostic tool designed for developers who need to understand the true risk profile of their software supply chain. Unlike standard audit tools that only flag known CVEs, this skill performs a deep dive into the vitals of every package in your tree, assessing maintainer activity, bus factor risks, and code bloat. It provides a clear, actionable report card to help you decide which dependencies are worth keeping and which are liabilities waiting to happen.
As a core utility among Openclaw Skills, it focuses on the things that actually matter for long-term project stability. It answers the difficult questions: Is the maintainer still active? How many transitive dependencies are being pulled in for a single function? Is the project a mass-deletion away from breaking your production environment? By synthesizing registry data and manifest analysis, it delivers a risk-adjusted report that goes far deeper than version drift.
Dependency Autopsy Use Cases
- Evaluating a new package's long-term viability before adding it to your project.
- Performing monthly health checks on existing production dependency trees to identify abandoned libraries.
- Identifying the source of unexpected bundle size growth in web applications.
- Conducting supply chain risk assessments during security audits or compliance reviews.
- Determining the difficulty and necessity of replacing a deeply integrated but failing dependency.
How Dependency Autopsy Works
- Scans project manifest files to map the entire dependency tree, including all transitive packages.
- Analyzes registry metadata to determine the project pulse by looking at meaningful code commits and release frequency.
- Calculates the bus factor by identifying unique committers and verifying organizational versus personal ownership.
- Audits package usage to determine the bloat factor, comparing exported functions used against the total package size.
- Performs a license health check to identify potential legal landmines like GPL transitive dependencies.
- Generates a comprehensive Autopsy Report Card with health scores across seven vital signs and specific replacement recommendations.
Dependency Autopsy Setup
To begin using Dependency Autopsy within your Openclaw Skills workflow, follow these installation steps:
# Install the dependency-autopsy skill via the CLI
openclaw install dependency-autopsy
# Navigate to your project root and run the analysis
openclaw run dependency-autopsy .
This skill requires no external API keys as it utilizes local manifest analysis and public registry data to perform its examination.
Dependency Autopsy Data Schema & Taxonomy
The skill organizes its findings into a structured taxonomy for easy interpretation. The following table highlights the primary data points tracked:
| Category | Metrics Tracked |
|---|---|
| Vital Signs | Pulse (Activity), Bus Factor (Maintainer Health), Bloat Factor (Weight) |
| Risk Analysis | Replacement Difficulty, Version Health, License Compliance |
| Tree Stats | Total package count, maximum depth, install size (MB), estimated used code |
| Recommendations | Suggested alternatives, estimated upgrade effort, inlining opportunities |
Dependency Autopsy Advanced Features
- Recursive mapping of deep dependency trees up to 11+ levels.
- Detection of ghost packages with zero downloads or those that exist solely as wrappers.
- Analysis of install scripts to identify potential supply chain attack vectors.
- Automatic recommendation engine that suggests modern, actively maintained library replacements.
- Tree-shaking evaluation to determine if a package can be optimized for frontend bundles.
SKILL.md
Loading
Related Openclaw Skills
Context Resume
Reconstructs your full developer mental state and task context after any interruption or time away from the keyboard.
Commit Poetry
Commit Poetry is a creative tool that transforms your git history into various poetic forms based on the nature of your code changes.
Code Weather
A diagnostic utility that translates technical codebase metrics like test coverage and complexity into an intuitive, metaphor-driven weather forecast.
Code Oracle
Code Oracle is a mystical fortune-teller for your codebase that transforms real technical metrics into engaging prophecies and tarot-style readings.
Dream State
A lateral thinking engine that solves complex engineering problems by mapping solution patterns from unrelated domains like biology, music, and physics onto technical challenges.
Dungeon Debug
Dungeon Debug transforms technical debugging sessions into an immersive text-based RPG dungeon crawl to ensure systematic error resolution.
Featured*
