What problem does it solve? Choosing between dependency alternatives is often driven by popularity or habit rather than evidence of project health. This Skill computes a 0-10 Dependency Fitness Score (DFS) for open-source packages so you can compare alternatives on maintenance, adoption, bus factor, security hygiene, and release discipline before pinning anything in a manifest. ## Core Features & Use Cases - Gate-based rejection: Automatically rejects packages with disallowed licenses, archived repositories, deprecation flags, or unpatched critical advisories before scoring. - Five-component health score: Weighted geometric mean of responsiveness (external issue handling), adoption (reverse dependencies, not stars), bus factor (human stewards only, bots excluded), security hygiene (advisory fix latency plus OpenSSF Scorecard), and release discipline (registry-based cadence). - Manifest auditing: Score every direct dependency in a Cargo.toml, package.json, requirements.txt, or pyproject.toml in one run, with path and workspace-internal dependencies skipped safely. - Use Case: You are deciding between two HTTP client libraries for a Rust project. Run the scoring script on both crates, compare their DFS values and reason codes, and reject the one with a single maintainer and stale releases despite its higher star count. ## Quick Start Ask the agent to score and compare the health of specific packages, for example by running the depscore script on cargo:serde and npm:express with a GITHUB_TOKEN set in the environment.
