What problem does it solve? Teams often add npm, pip, or Go packages impulsively, accumulating bloated, unmaintained, or vulnerable dependencies with no record of why they were chosen. This Skill enforces a documented decision gate before any new major dependency is installed. ## Core Features & Use Cases - Mandatory Decision Record: Requires an entry in .ai/DECISIONS.md covering justification, alternatives considered, size, security track record, maintenance status, license, and rollback plan before installation. - Human Approval Gate: Blocks installation until a human sets Decision: <chosen option> in the decision record. - Existing Dependency Awareness: Injects the current dependency list from package.json or requirements.txt into context so new additions are evaluated against what is already installed. - Use Case: Before running npm install lodash, the Skill prompts you to record why lodash is needed, what alternatives were weighed, its CVE history, and how to remove it — then waits for explicit approval. ## Quick Start Ask the agent to add a new package such as "run the dependency gate before installing axios" and it will draft the DECISIONS.md entry for your approval.
