andrew

Evaluates packages, manages dependencies, and addresses supply chain security. Use when adding npm/pip/cargo/bundler/go dependencies, auditing packages, reviewing lockfile changes, checking for vulnerabilities, comparing package alternatives, or assessing package trustworthiness.

Assess whether a given repository is a "bernie", a package that is still depended on but no longer actively maintained, and produce a remediation recommendation covering maintainer state and security posture. Use when reviewing a dependency, auditing a project's risk, or evaluating an open-source library before adopting it.