dependency-management

---

name: dependency-management description: Use when someone wants to add, upgrade, or vendor a third-party package and the org requires approval first — or when a PR adds a dependency that has not been license- and CVE-checked. Runs the request through the approval workflow: license compatibility, known-CVE scan (including transitive deps), sign-off, then a properly regenerated lockfile. Blocks copyleft licenses in proprietary services and refuses hand-edited lockfiles.

Dependency Approval Workflow

Overview

Every new dependency is new attack surface, new license obligation, and new code the org now maintains by proxy. This skill runs a dependency request through the organization's approval gate before it lands: license check, known-CVE check (covering the transitive tree, not just the named package), human sign-off, and a lockfile regenerated by the package manager rather than hand-edited. The goal is that nothing reaches the lockfile without passing the gate.

When to Use

Use this skill when you see symptoms like:

• A request to add, upgrade, or vendor a third-party package.
• A PR introduces a new dependency that has not been reviewed.
• A package.json / requirements.txt / go.mod change pulls in unfamiliar packages.
• Someone asks "can we use library X?" or "is this dependency approved?"
• A security scan flags a dependency and you need to decide whether to keep it.

Do NOT use this skill when:

• You are only updating application code with no dependency change.
• The package is already approved and you are pinning to the same vetted version.
• The task is debugging runtime behavior, not vetting a new dependency.

Approval flow

1. Request. Capture the package(s), the requested version(s), and why they are needed. A specific reason makes the rest of the review tractable.

2. Resolve the full tree. Approval is meaningless without the transitive deps, because that is where unreviewed packages hide. Produce a resolved tree (npm ls --json, pip download + inspect, go mod graph, etc.) so every indirect dependency is in scope.

3. License + CVE check. Run scripts/check_deps.py against the resolved tree. It flags copyleft/incompatible licenses (including transitively) and queries OSV.dev for known-CVE versions.

   # check the resolved tree under a proprietary-service license policy
   python scripts/check_deps.py --tree resolved.json --policy proprietary --ecosystem npm
   
   # check explicit packages
   python scripts/check_deps.py --pkg some-lib@2.1.0 --pkg helper@0.4.0
   
   # offline (license check only, skip the CVE network call)
   python scripts/check_deps.py --tree resolved.json --no-network
   

   The script exits non-zero if anything blocks approval, so it can gate CI.

4. Approval / sign-off. If the gate is clean, get the required approver to sign off. If it is not clean, resolve each finding first: pick a permissively-licensed alternative, bump past the CVE, or get an explicit exception.

5. Regenerate the lockfile. Add the dependency through the package manager and let it regenerate the lockfile (npm install, poetry lock, go mod tidy). Never hand-edit lockfile hashes or versions.

Gotchas

• ALWAYS resolve and check the transitive tree. Approving only the named package lets it drag in dozens of unreviewed transitive dependencies. The license or CVE problem is usually three levels down, not in the package you were asked about.
• ALWAYS enforce license compatibility for the service type. A copyleft license (GPL/AGPL) inside a proprietary service can create an obligation to release source. Permissive (MIT/Apache/BSD) is generally fine; copyleft and "unknown" need explicit review. The check script blocks copyleft under the proprietary policy.
• ALWAYS reject known-CVE versions. A package can be fine in general but pinned to a version with a published advisory. Check the exact requested version, and bump past the fix rather than approving the vulnerable pin.
• ALWAYS regenerate the lockfile — never hand-edit it. Hand-editing a lockfile desyncs the integrity hashes from what the resolver would produce, defeats reproducible installs, and can silently reintroduce a version the gate rejected. Let the package manager write it.

Files

• SKILL.md — this file; the approval workflow and dependency gotchas.
• scripts/check_deps.py — license + known-CVE gate over a resolved dependency tree (covers transitive deps); queries OSV.dev with an offline fallback. Advisory only — never installs or edits the lockfile.