12_dependency_tree_mapping_skill

Overview

This skill builds a comprehensive dependency graph of a codebase to reveal structural risks and impact chains. It identifies critical nodes, cycles, and version conflicts and outputs visual and machine-readable artifacts for analysis. The goal is to surface single-points-of-failure and guide safe refactors or upgrades.

How this skill works

The script detects the project tech stack and runs language-appropriate extractors (npm, dotnet, pipdeptree, cargo) to collect declared and transitive dependencies. It transforms the raw dependency data into Mermaid, JSON, or plain text graphs and computes node centrality to flag critical libraries. Outputs include a visual DEPENDENCY_GRAPH.mmd and a RISK_REPORT.md summarizing critical nodes, cycles, and version issues.

When to use it

• Before major upgrades or dependency bumps
• During architectural refactoring to assess blast radius
• As part of QA or release checklists to detect single-points-of-failure
• When onboarding a new service to understand upstream/downstream impact
• Regular dependency audits for security and maintainability

Best practices

• Run from the repository root or provide --workspace-path to ensure full coverage
• Use a realistic --depth to balance detail and noise (default 3)
• Resolve local environment tooling (npm, dotnet, pipdeptree) before scanning
• Review RISK_REPORT.md with stakeholders before changing high-centrality nodes
• Combine results with CI gates to block risky dependency changes

Example use cases

• Map a monorepo to find a library used by >50% of services and plan staggered updates
• Assess impact of replacing a deprecated package before merging a pull request
• Detect circular dependencies that cause intermittent build failures
• Produce a visual graph for architecture reviews and documentation
• Create a JSON export for automated risk dashboards and policy enforcement