Menu
Dependency audit, update policy, license verification, and supply chain security practices.
Install with Codex or Claude Copy this prompt, paste it into Codex, Claude, or another assistant, and let it review the skill page and install it for you.
Based on SOC occupation classification
Rules and strategies for managing agent context window size, avoiding bloat, and preserving signal-to-noise ratio.
Standard patterns for error handling, retry logic, circuit breakers, and graceful degradation.
Detect and remove contradictions across agent policies before execution.
Multi-step tool workflows via code orchestration to reduce latency, context pollution, and token overhead.
Bind project-specific prompts to local schema and workflow artifacts while keeping the harness core generic and globally reusable.
Operational session protocol for task-scoped leases, reconciliation, checkpoints, inspection, queue promotion, and handoff across long-running work.
| name | dependency-management |
| description | Dependency audit, update policy, license verification, and supply chain security practices. |
Ensure dependencies are secure, up-to-date, properly licensed, and not unnecessarily bloating the project.
npm audit reports vulnerabilitiesBefore adding any new dependency, evaluate:
| Criterion | Requirement |
|---|---|
| Necessity | Can this be done with existing deps or < 50 lines of code? |
| Maintenance | Last commit < 6 months ago, > 1 maintainer |
| Popularity | > 1K weekly downloads (exceptions for niche tools) |
| Size | Check with bundlephobia.com — flag if > 50 KB gzipped |
| License | Must be compatible (MIT, Apache-2.0, BSD — avoid GPL in proprietary projects) |
| Security | No open critical/high CVEs on npm audit or Snyk |
| Type support | Has TypeScript types (built-in or @types/*) |
If a dependency fails 2+ criteria, prefer an alternative or implement in-house.
| Update type | Action | Timing |
|---|---|---|
| Patch (x.x.X) | Auto-update | Weekly |
| Minor (x.X.0) | Review changelog, then update | Bi-weekly |
| Major (X.0.0) | Full impact analysis + migration plan | On demand |
npm outdated to identify stale dependencieschore/update-deps-<date>)Run regularly (at minimum before each release):
npm audit
npm audit fix # auto-fix non-breaking patches
npm audit --omit=dev # check production deps only
| Severity | Response time | Action |
|---|---|---|
| Critical | Immediate | Patch or replace dependency |
| High | < 24 hours | Patch, replace, or document mitigation |
| Moderate | Next sprint | Update or pin to patched version |
| Low | Best effort | Track in backlog |
Maintain a list of approved licenses:
Permissive (auto-approved): MIT, Apache-2.0, BSD-2-Clause, BSD-3-Clause, ISC, 0BSD, Unlicense
Restrictive (requires review): LGPL-*, MPL-2.0
Prohibited (in proprietary projects): GPL-, AGPL-, SSPL
Use npx license-checker --summary to audit the current tree.
package-lock.json (or equivalent)code-review — verify new deps in PR reviewperformance-audit — check bundle size impact of new depscompletion-gate — npm audit with no critical/high vulnerabilitiesis-odd)npm audit warnings indefinitely* or latest as version ranges