skills.rest
vovanostm-public
vovanostm-publicOFFICIAL
Explore all skills by this author →
GitHub

dependency-decision

Evaluates proposed dependencies for necessity, security, license, and operational risk.

Updated Jun 8, 2026
Search Tags:#dependency management#security review#risk assessment#package evaluation#approval workflow#license compliance
One-click install
npx skills add https://github.com/vovanostm-public/multica --skill dependency-decision-vovanostm-public
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: dependency-decision
Source: https://github.com/vovanostm-public/multica/tree/main/workflow-bundles/multica-specops-v5/codex_skills/.agents/skills/dependency-decision
Command: npx skills add https://github.com/vovanostm-public/multica --skill dependency-decision-vovanostm-public

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve? Teams often add new libraries, packages, or frameworks without a structured review, leading to bloated lockfiles, license violations, and unpatched security risks. This Skill enforces a consistent decision process before any dependency is approved. ## Core Features & Use Cases - Necessity Check: Verifies whether existing code, dependencies, or the standard library already solve the problem before approving anything new. - Risk Assessment: Evaluates maintenance status, popularity, license, security posture, transitive risk, and bundle/runtime impact. - Approval Gating: Classifies risk level and routes medium/high-risk additions to human or security review with a rollback plan. - Use Case: A developer proposes adding a new UI framework to the project. The Skill checks existing alternatives, audits the license and security posture, estimates bundle impact, and produces a typed decision record with an approval request. ## Quick Start Evaluate whether we should add the proposed package to the project and produce a dependency decision with risk classification and alternatives.

Frequently Asked Questions about dependency-decision

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I evaluate whether to add a new dependency to my project?▼

First check if existing code, dependencies, or the standard library solve the problem. Then evaluate maintenance activity, popularity, license, security posture, and transitive risk, estimate bundle and operational impact, and classify the risk level before approving.

What should a dependency review checklist include?▼

A dependency review should cover necessity versus existing alternatives, maintenance and popularity signals, license compatibility, known security vulnerabilities, transitive dependency risk, bundle or runtime size impact, and a rollback plan for the addition.

When does a new dependency require security or human approval?▼

Approval is required when the dependency has high impact or transitive risk, or when its security posture or license is unknown. Small dev-only tools can be allowed if scoped and documented, while medium and high risk additions are blocked pending review.

Can I add a dependency if an existing package already solves the problem?▼

No. If an existing dependency or the standard library is sufficient, the decision process rejects the new dependency to avoid lockfile bloat and duplicated functionality.

What are the limitations of automated dependency decision checks?▼

The process relies on available evidence about maintenance, license, and security, so unknown or unverifiable signals result in a blocked decision rather than approval. It also does not execute privileged actions directly and must request the approved action pipeline.

Related Skills

Explore More Software Engineering Skills→
nodesourcenodesource
6

ns-replace-package

Finds and evaluates npm package alternatives using NCM vulnerability and quality data.

Official
Intermediate
MS33834MS33834

Dependency Update

Plan and execute low-risk dependency updates with validation and rollback guidance.

Community
Advanced
AdeptMindAdeptMind

dependency-auditor

Audit project dependencies for vulnerabilities, outdated versions, and license conflicts.

Official
Advanced
nikblanchetnikblanchet

dependency-management

Select and integrate external libraries for Python and Node.js projects.

Community
Intermediate