New: 97,000+ skills indexed from GitHub repos with 100+ stars · every skill safety-checkedBrowse top skillsTop skills
Esc to closeBrowse all skills
Submit a skillBrowse skills
Submit a skillBrowse skills

Agent skill

Dependency Cycle Audit

by mtarcure in mtarcure/claude-vibe-squad

A skill your agent uses when module, package, or build dependencies may contain cycles, especially load-order failures, broad rebuilds, or a planned extraction: derive the real graph, compute…

MITAuto-check passed

Install Dependency Cycle Audit

skills CLI
$ npx skills add mtarcure/claude-vibe-squad --skill dependency-cycle-audit -a claude-code

Project install by default; add -g for ~/.claude/skills/.

GitHub CLI
$ gh skill install mtarcure/claude-vibe-squad dependency-cycle-audit --agent claude-code

Project scope by default; add --scope user for a personal install. Needs GitHub CLI 2.90.0 or later (public preview).

Manual copy
$ git clone --depth 1 https://github.com/mtarcure/claude-vibe-squad.git skills-src && mkdir -p .claude/skills && cp -r skills-src/.agents/skills/dependency-cycle-audit .claude/skills/dependency-cycle-audit && rm -rf skills-src

Use ~/.claude/skills/ instead of .claude/skills for a personal install. The folder must contain SKILL.md.

Claude Code skills documentation · loads skills from .claude/skills/

Facts

Skill name
dependency-cycle-audit
GitHub stars
162
Token cost
~1.5k tokens
SKILL.md length
819 words
Files
1
Skills in repo
17
Repo updated
First seen
Licence
MIT

At a glance

A skill your agent uses when module, package, or build dependencies may contain cycles, especially load-order failures, broad rebuilds, or a planned extraction: derive the real graph, compute…

  • Works in 8 steps: Fix the granularity first. A cycle… → Extract the edge list from ground truth.… → Compute strongly-connected components… → …
  • Build dependencies may contain cycles
  • SKILL.md covers When to use, Inputs, Steps and Outputs, plus 3 more sections
  • Instructions only: no scripts, shell commands, URLs or credentials in SKILL.md

What it does

Dependency Cycle Audit is an agent skill from mtarcure/claude-vibe-squad. Use when module, package, or build dependencies may contain cycles, especially load-order failures, broad rebuilds, or a planned extraction: derive the real graph, compute strongly connected components, rank cycle clusters, choose the minimal feedback-edge cut, and add an acyclicity guard.

Its SKILL.md is about 1.5k tokens, which your agent loads only when the skill is triggered. It is a single SKILL.md file with no bundled scripts.

The repository describes itself as: Multi-model AI orchestration where behaviour is Markdown, not code. One coordinator routes scoped task packets to 71 role-based specialists across 5 model families (Codex /… The licence is MIT.

When your agent uses it

  • Build dependencies may contain cycles
  • Especially load-order failures
  • A planned extraction: derive the real graph
  • Compute strongly connected components

Example prompts

  • “/dependency-cycle-audit”

Requirements

  • Python 3

Workflow steps

8 steps, taken from the first numbered list in SKILL.md.

  1. Fix the granularity first. A cycle visible at file level may be legal inside one package, while a package-level cycle breaks the build…
  2. Extract the edge list from ground truth. Use an import-graph or build-graph extractor for the ecosystem (a dependency-graph tool category…
  3. Compute strongly-connected components (Tarjan or Kosaraju; any graph library, or a short script over the edge list). Every SCC with more…
  4. Characterize each cluster: which edges close the cycle, each edge's weight (distinct symbols imported across it), and whether the edge is…
  5. Rank clusters by blast radius: fan-in of the cluster's members times the churn of its files (git log frequency). High fan-in, high-churn…
  6. Choose the break per edge, preferring the cut that removes the fewest, lightest edges (an approximation of the minimum feedback edge set)
  7. Re-extract the graph and recompute SCCs after each break. The cluster must dissolve, and no new cycle may appear — inversion done…
  8. Guard the result: add a CI assertion at the audited granularity (an import-contract linter rule, a build-graph acyclicity check) so the…

What it can do on your machine

Read from SKILL.md and the folder at commit 7bd69f8. It shows what the files ask for, not the result of running them.

  • Tool permissions

    Pre-approves nothing: there is no allowed-tools line, so your agent's usual permission prompts apply.

    From allowed-tools in the SKILL.md frontmatter.

  • Runs code

    No scripts in the folder and no shell commands in SKILL.md.

    From the folder's file list and the shell code blocks in SKILL.md.

  • Network

    No URLs in SKILL.md.

    From URLs in SKILL.md, links to its own repository left out.

  • Credentials

    Names no API keys, tokens, secrets or passwords.

    From names ending in _API_KEY, _TOKEN, _SECRET, _KEY or _PASSWORD in SKILL.md.

Context cost

Dependency Cycle Audit loads about 1.5k tokens when it runs. Until then it costs about 78 tokens; SKILL.md has 819 words of instructions outside code blocks.

Always · name and description, kept in context so the agent knows when to use it
~78
When it runs · the whole SKILL.md, loaded when a task matches
~1.5k

Estimates: characters ÷ 4, the usual rule of thumb; real counts depend on the model's tokenizer. Scripts and assets cost tokens only if the agent reads them.

Safety

Auto-check passed

The automated check found no risky patterns in SKILL.md.

Automated static check — not a guarantee. Review scripts before installing. It scans the text of SKILL.md for risky patterns (piping downloads into a shell, reading credential files, hidden Unicode, destructive commands); files beside SKILL.md are not scanned.

SKILL.md

The full file from mtarcure/claude-vibe-squad at commit 7bd69f8, republished under its MIT licence (© mtarcure). 819 words, ~1,466 tokens.

Download SKILL.mdSave it as .claude/skills/dependency-cycle-audit/SKILL.md (or your agent's skills folder).
name
dependency-cycle-audit
description
Use when module, package, or build dependencies may contain cycles, especially load-order failures, broad rebuilds, or a planned extraction: derive the real graph, compute strongly connected components, rank cycle clusters, choose the minimal feedback-edge cut, and add an acyclicity guard.
audience
specialist

Dependency Cycle Audit

Find every dependency cycle at the granularity the build or loader actually enforces, rank the cycle clusters by blast radius, and break each with the cheapest cut that removes the coupling instead of hiding it.

When to use

  • Before approving an architecture change, module split, or extraction of a shared library.
  • When builds rebuild "everything" on small changes, tests cannot run in isolation, or imports fail depending on load order.
  • After a refactor that moved code between modules — cycles regrow silently.

Inputs

  • The codebase at a fixed revision, and its dependency ground truth: import statements, build-file dependency declarations, package manifests, linker inputs — never a diagram or a doc.
  • The enforcement level to audit at: package, module, file, or build target.

Steps

  1. Fix the granularity first. A cycle visible at file level may be legal inside one package, while a package-level cycle breaks the build; audit at the level the toolchain enforces, and say which level you chose.
  2. Extract the edge list from ground truth. Use an import-graph or build-graph extractor for the ecosystem (a dependency-graph tool category exists for every major toolchain: import-graph analyzers, build-graph query commands, module-dependency linters); where none is at hand, grep the import forms directly. Record the extraction command so the audit is repeatable.
  3. Compute strongly-connected components (Tarjan or Kosaraju; any graph library, or a short script over the edge list). Every SCC with more than one node is a cycle cluster. Enumerate all of them — do not stop at the first cycle found; cycles cluster, and the count is the honest baseline.
  4. Characterize each cluster: which edges close the cycle, each edge's weight (distinct symbols imported across it), and whether the edge is load-bearing (core call path) or incidental (one type reference, a convenience re-export, a leftover import).
  5. Rank clusters by blast radius: fan-in of the cluster's members times the churn of its files (git log frequency). High fan-in, high-churn cycles invalidate the most builds and tests — break those first; a stable low-fan-in cycle may be acceptable, documented, for now.
  6. Choose the break per edge, preferring the cut that removes the fewest, lightest edges (an approximation of the minimum feedback edge set):
    • Delete incidental edges — unused imports and convenience re-exports just go.
    • Re-home a misplaced piece — often one function or type sits in the wrong module and carries the whole back-edge.
    • Extract a shared kernel — move the types both sides need into a new leaf module both depend on.
    • Invert a genuine mutual dependency — the lower module defines an interface/protocol/callback; the higher module implements and injects it.
  7. Re-extract the graph and recompute SCCs after each break. The cluster must dissolve, and no new cycle may appear — inversion done carelessly can relocate a cycle rather than remove it.
  8. Guard the result: add a CI assertion at the audited granularity (an import-contract linter rule, a build-graph acyclicity check) so the cycle cannot regrow unnoticed.
Show full SKILL.md (331 more words)Show less

Outputs

  • The audit record: granularity, extraction command, revision, SCC count and membership.
  • Per broken cycle: the closing edges, the cut chosen and why it was the cheapest, and the re-check proving dissolution.
  • The CI guard that keeps the graph acyclic at that level.

Failure modes

  • Wrong granularity — a clean package graph hiding file-level tangles that block a planned module split, or vice versa; always state the level.
  • Merging the modules — the cycle "disappears" because the two nodes became one; the coupling is now invisible and worse.
  • Cutting the semantically central edge — forcing a huge refactor when a one-line incidental edge closed the same cycle; weigh edges before cutting.
  • Trusting stale maps — diagrams and docs describe the intended graph; only extracted edges describe the real one.
  • Masked runtime cycles — type-only imports, lazy/deferred imports, and service locators keep the static graph clean while initialization order still deadlocks at runtime; audit deferred-import sites separately.

Worked example

A Python service shows orders → billing → notifications → orders. Extraction (import-graph tool over src/) yields the edge list; SCC detection reports one 3-node cluster. Edge weights: orders→billing 14 symbols (load-bearing), billing→notifications 6 (load-bearing), notifications→orders 1 — a single Order type import used for a type hint. The cheapest cut is the 1-symbol back-edge: move Order into a new leaf models module (shared kernel); all three import models, the back-edge disappears. Re-run: zero multi-node SCCs. An import-linter contract (models may import nothing; no package may import orders except the API layer) goes into CI so the back-edge cannot return.

Acceptance

  • The audit names its granularity, revision, and extraction command; the edge list comes from code or build files, not documentation.
  • All multi-node SCCs are enumerated, not just the first found.
  • Each broken cycle records the closing edges, the chosen cut, and why cheaper cuts were not available.
  • A post-break re-extraction shows the cluster dissolved with no new cycles introduced.
  • A CI guard now enforces acyclicity at the audited level, or the residual cycle is documented as accepted with its blast radius.

© mtarcure, MIT. Rendered from Markdown: HTML in the file is shown as text, images as links, and headings moved down two levels. Raw file

Files

Just SKILL.md in .agents/skills/dependency-cycle-audit of mtarcure/claude-vibe-squad.

Open the folder on GitHubat commit 7bd69f8

Compare with similar skills

Dependency Cycle Audit next to the 5 skills that share the most tags, products or categories with it. Stars are the repository's; “used in” counts other GitHub owners with a copy.

Dependency Cycle Audit compared with similar skills
SkillStarsUsed inTokensAuto-checkLicenceRepo updated
Dependency Cycle Audit this skillmtarcure/claude-vibe-squad162—~1.5kAutomated safety check: PassMIT
Megatron-LM Container and Dependency SetupNVIDIA/Megatron-LM18k—~2.6kAutomated safety check: PassApache-2.0
Dependency Scanningsickn33/agentic-awesome-skills47k1 repos~2.4kAutomated safety check: PassMIT
Dependency Checkruvnet/ruflo74k—~258Automated safety check: PassMIT
Dependency Updatecodewhale-hq/Codewhale41k—~142Automated safety check: PassMIT
Apple Containersickn33/agentic-awesome-skills47k1 repos~2.5kAutomated safety check: PassApache-2.0

Similar skills

  • Megatron-LM Container and Dependency Setup

    NVIDIA/Megatron-LM

    Official

    Walks an agent through working inside the Megatron-LM CI container and changing dependencies with uv, so lock files resolve the same locally and in CI.

    18k GitHub stars~2.6k tokensUpdated today
    DevelopmentAuto-check passed

  • Dependency Scanning

    sickn33/agentic-awesome-skills

    Scan package dependencies for known vulnerabilities using Snyk, Dependabot, and OWASP Dependency-Check.

    47k GitHub starsUsed in 1 repo~2.4k tokens
    SecurityAuto-check passed

  • Dependency Check

    ruvnet/ruflo

    Scan project dependencies for known vulnerabilities and CVEs.

    74k GitHub stars~258 tokensUpdated today
    SecurityAuto-check passed

  • Dependency Update

    codewhale-hq/Codewhale

    Read release notes/changelogs, update a defined dependency scope, handle breaking changes, and verify.

    41k GitHub stars~142 tokensUpdated today
    DevelopmentAuto-check passed

  • Apple Container

    sickn33/agentic-awesome-skills

    Build, run, and manage OCI/Linux containers as lightweight per-container VMs on Apple-silicon macOS using Apple's open-source container CLI, no Docker daemon required.

    47k GitHub starsUsed in 1 repo~2.5k tokens
    DevOps & CloudAuto-check passed

  • Performing Container Security Scanning With Trivy

    mukul975/Anthropic-Cybersecurity-Skills

    Runs Trivy across every target type it supports - container images, filesystems, Git repositories, and Kubernetes clusters - for OS and dependency vulnerabilities, IaC misconfiguration, exposed…

    34k GitHub stars~818 tokensUpdated 1 mo ago
    DevOps & CloudAuto-check passed

More from mtarcure/claude-vibe-squad

All 17 skills in this repo

  • Systematic Attacking

    mtarcure/claude-vibe-squad

    A skill your agent uses for ALL authorized offensive-security / bug-bounty work — the single method to find, chain, prove, dedup, and package the highest-value (High/Critical) findings across every…

    162 GitHub stars~3.6k tokensUpdated 17 days ago
    Auto-check passed

  • Blind Rediscovery

    mtarcure/claude-vibe-squad

    Operational checklist + helper for blind-rediscovery fan-out work.

    162 GitHub stars~1.6k tokensUpdated 17 days ago
    Auto-check passed

  • Chain Construct Smart Contract

    mtarcure/claude-vibe-squad

    A skill your agent uses when you have a confirmed on-chain vulnerability hypothesis and must demonstrate it with a passing proof-of-concept — author an attacker contract or crafted instruction…

    162 GitHub stars~1.5k tokensUpdated 17 days ago
    Auto-check passed

  • Compact Now

    mtarcure/claude-vibe-squad

    Operator-triggered proactive compaction — Chrono externalizes load-bearing state (active decisions, open tasks, next action) to a snapshot + a durable Vault learning note before invoking Claude…

    162 GitHub stars~1.6k tokensUpdated 17 days ago
    Auto-check passed

  • Agent Prompt Engineering

    mtarcure/claude-vibe-squad

    A skill your agent uses when building or revising the system prompt for a product agent and you need an eval-backed boundary, tool-use, grounding, and output contract.

    162 GitHub stars~872 tokensUpdated 17 days ago
    Auto-check: warnings

  • Defi Invariant Check

    mtarcure/claude-vibe-squad

    A skill your agent uses when the audit target is a DeFi protocol — AMM, lending market, yield vault, stablecoin, or perps — and you must author the economic properties generic campaigns miss, such…

    162 GitHub stars~2.5k tokensUpdated 17 days ago
    Auto-check passed

Questions about Dependency Cycle Audit

What does Dependency Cycle Audit do?

A skill your agent uses when module, package, or build dependencies may contain cycles, especially load-order failures, broad rebuilds, or a planned extraction: derive the real graph, compute…. Dependency Cycle Audit is an agent skill from mtarcure/claude-vibe-squad. Use when module, package, or build dependencies may contain cycles, especially load-order failures, broad rebuilds, or a planned extraction: derive the real graph, compute strongly connected components, rank cycle clusters, choose the minimal feedback-edge cut, and add an acyclicity guard.

When should I use Dependency Cycle Audit?

Dependency Cycle Audit fits situations like: build dependencies may contain cycles; especially load-order failures; A planned extraction: derive the real graph; compute strongly connected components.

How do I install Dependency Cycle Audit in Claude Code?

Run `npx skills add mtarcure/claude-vibe-squad --skill dependency-cycle-audit -a claude-code`. Or copy the skill folder (.agents/skills/dependency-cycle-audit in mtarcure/claude-vibe-squad) into .claude/skills/dependency-cycle-audit in your project. Claude Code loads it when a task matches its description.

How do I install Dependency Cycle Audit in Codex?

Run `npx skills add mtarcure/claude-vibe-squad --skill dependency-cycle-audit -a codex`. Or copy the skill folder (.agents/skills/dependency-cycle-audit in mtarcure/claude-vibe-squad) into .agents/skills/dependency-cycle-audit in your project. Codex loads it when a task matches its description.

Can I use Dependency Cycle Audit in Cursor, Gemini CLI or GitHub Copilot?

Cursor, Gemini CLI, GitHub Copilot and OpenCode also load SKILL.md folders. With the skills CLI, run `npx skills add mtarcure/claude-vibe-squad --skill dependency-cycle-audit -a cursor` (or -a gemini-cli, github-copilot or opencode for the others). To copy it by hand, put the folder in .cursor/skills/dependency-cycle-audit, .gemini/skills/dependency-cycle-audit, .github/skills/dependency-cycle-audit and .opencode/skills/dependency-cycle-audit in your project.

What does Dependency Cycle Audit need to run?

SKILL.md names no scripts, command-line tools or credentials: Dependency Cycle Audit is instructions for the agent only. Our summary lists: Python 3.

Does Dependency Cycle Audit access the network?

SKILL.md contains no URLs. Any network use would come from the scripts or tools the agent runs. This is read from the text; nothing was executed.

Is Dependency Cycle Audit safe to install?

Our automated static check of SKILL.md found no risky patterns, such as piping downloads into a shell, reading credential files or hidden Unicode. It is not a guarantee. Review the folder before installing.

What licence does Dependency Cycle Audit use?

Dependency Cycle Audit is published under the MIT licence (the repository's licence). It allows redistribution, so the full SKILL.md is shown on this page.

How many tokens does Dependency Cycle Audit use?

About 1.5k tokens (SKILL.md is roughly 5.9k characters). Agents keep only the skill's name and description in context until a task matches; then they load SKILL.md in full.

What are the alternatives to Dependency Cycle Audit?

Skills that share tags, products or a category with Dependency Cycle Audit: Megatron-LM Container and Dependency Setup (NVIDIA/Megatron-LM, 18k stars), Dependency Scanning (sickn33/agentic-awesome-skills, 47k stars), Dependency Check (ruvnet/ruflo, 74k stars) and Dependency Update (codewhale-hq/Codewhale, 41k stars). The comparison table on this page puts their stars, adoption, token cost, safety result and licence side by side.

Who maintains Dependency Cycle Audit?

mtarcure (a GitHub user) maintains it in mtarcure/claude-vibe-squad, which has 162 GitHub stars. The repository holds 17 skills in this directory. The repository was last updated on September 21, 2026.

Source: mtarcure/claude-vibe-squad on GitHub. Facts on this page come from the repository at the commit we read; the author's words are quoted as theirs.