Skill · before anything is installed

Dependency Guard

Most dependencies are never decided — a request’s obvious implementation is npm install x, and that is the whole review. This asks whether it should come in, and whether it is even the package you think it is.

Soumya Rauth · Creator & maintainer

npx skills add soumyaRauth/skills-hub --skill dependency-guard

The problem

request → npm install x → nobody decides again

Every dependency is a lasting grant. Code nobody here wrote runs in the build, often at install time. Its transitive tree grows without anyone choosing it. And a mistyped or invented name installs somebody else’s package.

Coding agents make all three more likely: they reach for a library by reflex, even for eight lines of code, and occasionally name packages that do not exist — exactly the gap a squatter registers into.

When it activates

No slash command needed. Installed, it is loaded when a request needs it and stays out of the way otherwise — and when it does shape the work, one ⚡ line says so. How the skills work together →

Engages	The work would add, replace or major-upgrade a dependency — a package, SDK, framework, build tool, GitHub Action or base image — or someone asks which library to use.
Stays quiet	Routine patch bumps that bring no new packages or install scripts, and removals.
Depth	A decision in a few lines before anything installs. A fuller evaluation for a major upgrade or a choice between libraries. Never a gate.
Works with	Standards Compass, Impact Map, ProofBuild, Production Guard

What it does

the need → already here? codebase · standard library · installed · a few lines
   → the one intended? resolves · publisher · repository
   → what comes with it? install scripts · transitive growth · license
   → USE EXISTING · ADD · ADD WITH CONDITIONS · DON’T ADD

You:    Add lodash so we can debounce the customer search box.

Agent:  DEPENDENCY  lodash — debounce for the customer search box
        DECISION    USE EXISTING
        WHY         The need is one function. src/lib/timing.js already holds
                    throttle(); a 9-line debounce beside it covers this.

        [… adds debounce() beside throttle(), with two tests …]

Is it the package you think it is?

$ pip index versions flask-safeupload-validator
ERROR: No matching distribution found for flask-safeupload-validator

DECISION    DON’T ADD — the name does not resolve on PyPI
WHY         Pillow, already installed, verifies the format from content
            and caps dimensions.

A name is resolved before it is trusted. One that does not resolve is not “probably fine”, and no similar-looking name is substituted quietly — that would be a new dependency decision, made without anyone noticing.

Never an invented number

Versions, downloads, maintainers, advisories and transitive counts come from output actually read — registry metadata, a dry run, the lockfile diff, the ecosystem’s audit tool — or they are marked UNVERIFIED. A plausible number is worse than none, because it is the one that gets repeated.

Where it fits

Standards Compass audits dependency management across the whole project; this decides one dependency at a time, as it arrives. A major upgrade’s broken call sites go to Impact Map, and the proof that it still works to ProofBuild.