Dependency Doctor

Inspect one dependency manifest on the user's machine for direct, surface-level footguns. Explain each finding in plain language, then offer a small, reviewable fix. This does not diagnose a failed pip or uv resolution.

This is a local developer tool for a project the user chooses. It is not a repository-wide lint rule, a CI gate, or a proposal to enforce dependency policy across unrelated apps.

When to use

• The user asks to check, audit, diagnose, or autopsy a dependency manifest
• The user wants to rule out direct-manifest issues before deeper install debugging
• The user suspects stale pins, backports, duplicate entries, or dependency rot
• The user asks whether anything looks wrong with their dependencies

When not to use

• Installing the current dependencies without diagnosing them
• Upgrading every package or adding a new package
• A full vulnerability audit. Use pip-audit, npm audit, or the project's approved security scanner for CVE coverage
• Creating a repo-wide CI check. This skill is user-invoked and local

Choose the manifest

Use the path the user names. If no path is given and several manifests exist, ask which one to inspect.…