dependency-audit

Name: dependency-audit
Author: Archive228

712stars129forks

How to install dependency-audit?

archive228/loopkit/dependency-audit

$npx -y skills add Archive228/loopkit --skill dependency-audit

Installs into the current project.

Summary

Decide whether to add, keep, or remove a dependency. Use before adding any package.

Files · 1

SKILL.md

1	# Dependency Audit
2	Before adding a package, ask:
3	1. Can the stdlib do it? No lodash for `Array.map`. No left-pad-tier packages.
4	2. Is it already in the tree? Don't add axios if the project uses fetch.
5	3. Is it alive? Last commit, open issues, maintainer responsiveness.
6	4. Cost? A 500KB dep to format a date isn't worth it. Check the install size and transitive deps.
7	5. Security? Known CVEs? Postinstall scripts?
8	When you do add one, justify it in the PR body. Never silently grow package.json. For existing deps: anything unused or one-function gets removed.

6 picks

Type

1	# Dependency Audit
2	Before adding a package, ask:
3	1. Can the stdlib do it? No lodash for `Array.map`. No left-pad-tier packages.
4	2. Is it already in the tree? Don't add axios if the project uses fetch.
5	3. Is it alive? Last commit, open issues, maintainer responsiveness.
6	4. Cost? A 500KB dep to format a date isn't worth it. Check the install size and transitive deps.
7	5. Security? Known CVEs? Postinstall scripts?
8	When you do add one, justify it in the PR body. Never silently grow package.json. For existing deps: anything unused or one-function gets removed.

1	# Dependency Audit
2	Before adding a package, ask:
3	1. Can the stdlib do it? No lodash for `Array.map`. No left-pad-tier packages.
4	2. Is it already in the tree? Don't add axios if the project uses fetch.
5	3. Is it alive? Last commit, open issues, maintainer responsiveness.
6	4. Cost? A 500KB dep to format a date isn't worth it. Check the install size and transitive deps.
7	5. Security? Known CVEs? Postinstall scripts?
8	When you do add one, justify it in the PR body. Never silently grow package.json. For existing deps: anything unused or one-function gets removed.