Plugin

Dependency Checker

Check dependencies for known vulnerabilities, outdated packages, and license compliance

Type: Plugin
Repository: jeremylongshore/tons-of-skills-marketplace
GitHub stars: 2.8k
License: MIT
Repo last updated: Sep 27, 2026
Source file: plugins/security/dependency-checker/.claude-plugin/plugin.json
Version: 1.27.0
Author: Jeremy Longshore

What Dependency Checker is

Dependency Checker is a plugin published in the jeremylongshore/tons-of-skills-marketplace repository on GitHub, which has about 2.8k stars. The repository describes itself as: “Model-agnostic agent-skills platform with a harness-free canonical layer, verified adapters, and the ccpi package manager. Explore at tonsofskills.com.”

A plugin is a package that bundles skills, slash commands, subagents, hooks, and MCP connectors so they install together. Plugins are plain files with a manifest at .claude-plugin/plugin.json, and they work in both Claude Code and Claude Cowork.

Installing Dependency Checker adds everything it ships in one step. Connectors inside a plugin still need to be connected separately, and hooks and subagents only run in Cowork and Claude Code, not in regular chat.

How to install Dependency Checker

Claude Code

Add the repository as a plugin marketplace: claude plugin marketplace add jeremylongshore/tons-of-skills-marketplace
Install the plugin: claude plugin install dependency-checker@<marketplace-name>, using the marketplace name from the repository's .claude-plugin/marketplace.json.
Restart the session if the new skills or commands don't appear straight away.

Claude Cowork

Open Customize → Plugins and choose Add marketplace.
Enter jeremylongshore/tons-of-skills-marketplace (the owner/repo shorthand works for GitHub).
Find Dependency Checker in the list, click Install, then connect any connectors it needs from its Connectors tab.

New to extending Cowork? Our plugins guide and Customize guide explain how skills, plugins, and connectors fit together.

Inside the source file

An excerpt from plugins/security/dependency-checker/.claude-plugin/plugin.json, shared under the repository's MIT license. Read the full file on GitHub.

Check dependencies for known vulnerabilities, outdated packages, and license compliance across multiple package managers.

Features

Multi-Language Support - npm, pip, composer, gem, go modules
CVE Detection - Known vulnerability scanning
Version Analysis - Identify outdated packages
License Scanning - Check license compatibility
Transitive Dependencies - Scan entire dependency tree
Remediation Guidance - Safe upgrade recommendations

Installation

/plugin install dependency-checker@claude-code-plugins-plus

Usage

# Check all dependencies
/check-deps

# Or use shortcut
/depcheck

Supported Package Managers

Node.js: npm, yarn, pnpm (package.json)
Python: pip, pipenv, poetry (requirements.txt, Pipfile, pyproject.toml)
PHP: composer (composer.json)
Ruby: bundler (Gemfile)
Go: go modules (go.mod)

Report Structure

1. Vulnerability Summary

DEPENDENCY VULNERABILITIES
==========================
Total Packages: 150
Vulnerable: 5 (3.3%)
  - Critical: 1
  - High: 2
  - Medium: 2

2. Detailed Findings

CRITICAL: SQL Injection in sequelize
  Package: [email protected]
  CVE: CVE-2023-22578
  CVSS: 9.8 (Critical)
  Fix: Upgrade to [email protected]
  Command: npm install [email protected]

3. Outdated Packages

OUTDATED PACKAGES
=================
express: 4.17.1 → 4.18.2 (patch, security fixes)
lodash: 4.17.19 → 4.17.21 (patch, security fixes)
react: 17.0.2 → 18.2.0 (major, breaking changes)

4. License Issues

LICENSE COMPLIANCE
==================
 GPL-3.0 dependencies found (3 packages)
  - [email protected] (GPL-3.0)
  May conflict with MIT license

Best Practices

Run checks before deployments
Update dependencies regularly (weekly/monthly)
Test thoroughly after updates
Use lock files for reproducible builds
Monitor security advisories
Document why specific versions are pinned

Example Workflow

# 1. Check dependencies
/depcheck

# 2. Review vulnerability report

# 3. Update vulnerable packages
npm audit fix

# 4. Recheck to verify fixes
/depcheck

# 5. Run tests
npm test

# 6. Commit updated dependencies
git add package.json package-lock.json
git commit -m "fix: update vulnerable dependencies"

Requirements

Access to package manifest files
Read access to lock files
Network access for CVE database queries (optional)

License

MIT License - See LICENSE file for details

Before you install

Read the whole file first. Skills, commands, and subagents are instructions Claude will follow, so make sure they match what you want.
Check which tools, scripts, or MCP servers it uses. Local servers and scripts run with your permissions.
Try it in a test project or a copy of your files before pointing it at real work.
Pin the version you tested, and review changes before updating.
Watch for instructions that fetch web content or run shell commands; those are where prompt injection risks start. See our prompt injection guide.

FAQ

What is Dependency Checker?

Dependency Checker is a plugin for Claude Code and Claude Cowork from the jeremylongshore/tons-of-skills-marketplace repository on GitHub. Check dependencies for known vulnerabilities, outdated packages, and license compliance

How do I install Dependency Checker in Claude Code?

Add the repository as a plugin marketplace: claude plugin marketplace add jeremylongshore/tons-of-skills-marketplace Install the plugin: claude plugin install dependency-checker@<marketplace-name>, using the marketplace name from the repository's .claude-plugin/marketplace.json. Restart the session if the new skills or commands don't appear straight away.

Can I use Dependency Checker in Claude Cowork?

Open Customize → Plugins and choose Add marketplace. Enter jeremylongshore/tons-of-skills-marketplace (the owner/repo shorthand works for GitHub). Find Dependency Checker in the list, click Install, then connect any connectors it needs from its Connectors tab.

Is Dependency Checker safe to install?

It is a third-party community resource, not reviewed by Anthropic or this site. Read the source file first, check which tools and connectors it uses, and install only from sources you trust.

Similar resources

Browse all skills, subagents, and plugins →

Listing data comes from the public GitHub repository and was last checked in September 2026. Excerpts are © their authors and shared under MIT. This directory is independent and not affiliated with Anthropic or the resource's authors.