Dependency Doctor Agent Skill

Dependency Doctor inspects one dependency manifest for surface-level, direct-manifest footguns. It catches unpinned versions, standard-library shadowing, obsolete backports, and obvious intra-manifest conflicts; it does not diagnose a failed pip or uv dependency resolution. It is a local, user-invoked development tool, not a repository CI rule.

What it checks

• Python standard-library shadowing pins such as pathlib==1.0.1
• Obsolete backports such as dataclasses, typing, enum34, and futures
• Dependencies with no usable version constraint
• Duplicate entries and conflicting exact pins
• Fully yanked PyPI releases when --online is explicitly enabled

The offline core supports requirements.txt, PEP 621 or Poetry pyproject.toml, and package.json. It uses only the Python standard library.

Install

npx skills add https://github.com/Shubhamsaboo/awesome-llm-apps/tree/main/agent_skills/dependency-doctor

Then ask your agent: check my requirements.txt for dependency problems.

Run the script directly

python3 agent_skills/dependency-doctor/scripts/dep_doctor.py requirements.txt --json

The default command makes no network calls. To check exact Python pins for fully yanked PyPI releases, opt in:

python3 agent_skills/dependency-doctor/scripts/dep_doctor.py requirements.txt --json --online

The doctor reports findings and suggested fixes but does not edit the manifest. Run the eval from a clone before installing:

python3 agent_skills/evals/dependency-doctor/test_dep_doctor.py

Scope

This focused check does not resolve a complete dependency graph and does not query a vulnerability database. Use the project's approved audit tool for CVE coverage. Ask before enabling the PyPI lookup or applying any suggested fix.

Apache-2.0. Last verified: July 2026.