Menu
This rule automatically analyzes dependencies before they're installed to provide insights about maintenance frequency, security vulnerabilities, and popularity in the developer ecosystem.
Install with Codex or Claude Copy this prompt, paste it into Codex, Claude, or another assistant, and let it review the skill page and install it for you.
Based on SOC occupation classification
Biome JavaScript/TypeScript linter and formatter
Hono lightweight web framework on Cloudflare Workers
Cloudflare Workers edge computing platform
Laravel PHP framework best practices
MySQL database best practices and query patterns
Next.js with React 19 App Router patterns
| name | dependency-analysis |
| description | This rule automatically analyzes dependencies before they're installed to provide insights about maintenance frequency, security vulnerabilities, and popularity in the developer ecosystem. |
filters:
matches: | // Match package.json modifications and lock file changes package.json package-lock.json yarn.lock pnpm-lock.yaml
transforms: |
// Analyze dependencies when package files are modified
{{
const analyzeDependency = async (packageName, version) => {
try {
// Fetch package information from npm registry
const npmResponse = await fetch(https://registry.npmjs.org/${packageName});
const npmData = await npmResponse.json();
// Fetch GitHub data if repository is available
let githubData = null;
if (npmData.repository && npmData.repository.url) {
const repoUrl = npmData.repository.url.replace('git+', '').replace('.git', '');
const repoPath = repoUrl.split('github.com/')[1];
if (repoPath) {
const githubResponse = await fetch(`https://api.github.com/repos/${repoPath}`);
githubData = await githubResponse.json();
}
}
// Check for security vulnerabilities
const auditResponse = await fetch(`https://registry.npmjs.org/-/npm/v1/security/advisories/${packageName}`);
const auditData = await auditResponse.json();
// Calculate maintenance score
const lastRelease = new Date(npmData.time[npmData['dist-tags'].latest]);
const daysSinceRelease = Math.floor((Date.now() - lastRelease.getTime()) / (1000 * 60 * 60 * 24));
let maintenanceScore = 100;
if (daysSinceRelease > 365) maintenanceScore -= 40;
else if (daysSinceRelease > 180) maintenanceScore -= 20;
else if (daysSinceRelease > 90) maintenanceScore -= 10;
// Calculate popularity score
const weeklyDownloads = npmData.downloads?.weekly || 0;
let popularityScore = 100;
if (weeklyDownloads < 1000) popularityScore -= 50;
else if (weeklyDownloads < 10000) popularityScore -= 20;
else if (weeklyDownloads > 100000) popularityScore += 20;
// Calculate security score
const vulnerabilities = auditData.vulnerabilities || [];
let securityScore = 100 - (vulnerabilities.length * 20);
return {
packageName,
version,
maintenanceScore,
popularityScore,
securityScore,
lastRelease: daysSinceRelease,
weeklyDownloads,
vulnerabilities: vulnerabilities.length,
githubStars: githubData?.stargazers_count || 0,
recommendations: generateRecommendations(maintenanceScore, popularityScore, securityScore, vulnerabilities)
};
} catch (error) {
console.error(`Error analyzing ${packageName}:`, error);
return null;
}
};
const generateRecommendations = (maintenance, popularity, security, vulnerabilities) => {
const recommendations = [];
if (maintenance < 60) {
recommendations.push("โ ๏ธ Low maintenance activity - consider alternatives");
}
if (popularity < 50) {
recommendations.push("๐ Low popularity - may have limited community support");
}
if (security < 80) {
recommendations.push("๐ Security vulnerabilities detected - update or replace");
}
if (vulnerabilities.length > 0) {
recommendations.push(`๐จ ${vulnerabilities.length} security vulnerability(ies) found`);
}
return recommendations;
};
// Analyze all dependencies in package.json
const packageJson = JSON.parse(content);
const allDeps = {
...packageJson.dependencies,
...packageJson.devDependencies,
...packageJson.peerDependencies
};
const analysisResults = [];
for (const [name, version] of Object.entries(allDeps)) {
const result = await analyzeDependency(name, version);
if (result) {
analysisResults.push(result);
}
}
return {
analysis: analysisResults,
summary: generateSummary(analysisResults)
};
}}
examples:
input: | { "dependencies": { "lodash": "^4.17.21", "express": "^4.18.2" } } output: |
input: | { "dependencies": { "deprecated-package": "^1.0.0" } } output: |
tests:
input: "npm install express" output: "Analyzing express... โ Express is well-maintained with 1.8M weekly downloads. No security issues detected."
input: "yarn add vulnerable-package" output: "๐จ WARNING: vulnerable-package has 3 security vulnerabilities! Consider alternatives or update immediately."
input: "pnpm add abandoned-lib" output: "โ ๏ธ CAUTION: abandoned-lib hasn't been updated in 2 years. Low community support. Consider alternatives."
metadata: priority: high version: 1.0
npm install some-package
Analysis Output:
๐ Analyzing some-package...
๐ Package Analysis Results:
โ
Maintenance: Excellent (Last release: 15 days ago)
โ
Popularity: High (500k weekly downloads)
โ
Security: Clean (No vulnerabilities)
โญ GitHub: 2.3k stars
๐ก Recommendation: Great choice! This package is well-maintained and secure.
npm install old-vulnerable-package
Analysis Output:
๐จ WARNING: old-vulnerable-package Analysis
โ Maintenance: Poor (Last release: 400 days ago)
โ Popularity: Low (100 weekly downloads)
โ Security: Critical (5 vulnerabilities detected)
โญ GitHub: 50 stars
โ ๏ธ Recommendations:
- Package is poorly maintained and has security issues
- Consider alternatives: modern-alternative, secure-package
- If you must use this package, update to latest version
- Monitor for security patches
# Analyze all current dependencies
npm audit
Enhanced Output:
๐ Dependency Health Check
๐ฆ Total Dependencies: 45
โ
Well-maintained: 38 packages
โ ๏ธ Needs attention: 5 packages
๐จ Critical issues: 2 packages
๐ Summary:
- Average maintenance score: 85/100
- Average popularity score: 78/100
- Security vulnerabilities: 3 found
๐ก Action Items:
1. Update lodash to fix security vulnerability
2. Replace deprecated-package with modern-alternative
3. Monitor old-package for updates
npm install and npm auditnpm outdated for update recommendationsyarn add and yarn auditpnpm add and pnpm auditbun add and bun audit