Menu
This rule automatically analyzes dependencies before they're installed to provide insights about maintenance frequency, security vulnerabilities, and popularity in the developer ecosystem.
Installer avec Codex ou Claude Copiez ce prompt, collez-le dans Codex, Claude ou un autre assistant, puis laissez-le vérifier la page du skill et l'installer pour vous.
Basé sur la classification professionnelle SOC
Biome JavaScript/TypeScript linter and formatter
Hono lightweight web framework on Cloudflare Workers
Cloudflare Workers edge computing platform
Laravel PHP framework best practices
MySQL database best practices and query patterns
Next.js with React 19 App Router patterns
| name | dependency-analysis |
| description | This rule automatically analyzes dependencies before they're installed to provide insights about maintenance frequency, security vulnerabilities, and popularity in the developer ecosystem. |
filters:
matches: | // Match package.json modifications and lock file changes package.json package-lock.json yarn.lock pnpm-lock.yaml
transforms: |
// Analyze dependencies when package files are modified
{{
const analyzeDependency = async (packageName, version) => {
try {
// Fetch package information from npm registry
const npmResponse = await fetch(https://registry.npmjs.org/${packageName});
const npmData = await npmResponse.json();
// Fetch GitHub data if repository is available
let githubData = null;
if (npmData.repository && npmData.repository.url) {
const repoUrl = npmData.repository.url.replace('git+', '').replace('.git', '');
const repoPath = repoUrl.split('github.com/')[1];
if (repoPath) {
const githubResponse = await fetch(`https://api.github.com/repos/${repoPath}`);
githubData = await githubResponse.json();
}
}
// Check for security vulnerabilities
const auditResponse = await fetch(`https://registry.npmjs.org/-/npm/v1/security/advisories/${packageName}`);
const auditData = await auditResponse.json();
// Calculate maintenance score
const lastRelease = new Date(npmData.time[npmData['dist-tags'].latest]);
const daysSinceRelease = Math.floor((Date.now() - lastRelease.getTime()) / (1000 * 60 * 60 * 24));
let maintenanceScore = 100;
if (daysSinceRelease > 365) maintenanceScore -= 40;
else if (daysSinceRelease > 180) maintenanceScore -= 20;
else if (daysSinceRelease > 90) maintenanceScore -= 10;
// Calculate popularity score
const weeklyDownloads = npmData.downloads?.weekly || 0;
let popularityScore = 100;
if (weeklyDownloads < 1000) popularityScore -= 50;
else if (weeklyDownloads < 10000) popularityScore -= 20;
else if (weeklyDownloads > 100000) popularityScore += 20;
// Calculate security score
const vulnerabilities = auditData.vulnerabilities || [];
let securityScore = 100 - (vulnerabilities.length * 20);
return {
packageName,
version,
maintenanceScore,
popularityScore,
securityScore,
lastRelease: daysSinceRelease,
weeklyDownloads,
vulnerabilities: vulnerabilities.length,
githubStars: githubData?.stargazers_count || 0,
recommendations: generateRecommendations(maintenanceScore, popularityScore, securityScore, vulnerabilities)
};
} catch (error) {
console.error(`Error analyzing ${packageName}:`, error);
return null;
}
};
const generateRecommendations = (maintenance, popularity, security, vulnerabilities) => {
const recommendations = [];
if (maintenance < 60) {
recommendations.push("⚠️ Low maintenance activity - consider alternatives");
}
if (popularity < 50) {
recommendations.push("📉 Low popularity - may have limited community support");
}
if (security < 80) {
recommendations.push("🔒 Security vulnerabilities detected - update or replace");
}
if (vulnerabilities.length > 0) {
recommendations.push(`🚨 ${vulnerabilities.length} security vulnerability(ies) found`);
}
return recommendations;
};
// Analyze all dependencies in package.json
const packageJson = JSON.parse(content);
const allDeps = {
...packageJson.dependencies,
...packageJson.devDependencies,
...packageJson.peerDependencies
};
const analysisResults = [];
for (const [name, version] of Object.entries(allDeps)) {
const result = await analyzeDependency(name, version);
if (result) {
analysisResults.push(result);
}
}
return {
analysis: analysisResults,
summary: generateSummary(analysisResults)
};
}}
examples:
input: | { "dependencies": { "lodash": "^4.17.21", "express": "^4.18.2" } } output: |
input: | { "dependencies": { "deprecated-package": "^1.0.0" } } output: |
tests:
input: "npm install express" output: "Analyzing express... ✅ Express is well-maintained with 1.8M weekly downloads. No security issues detected."
input: "yarn add vulnerable-package" output: "🚨 WARNING: vulnerable-package has 3 security vulnerabilities! Consider alternatives or update immediately."
input: "pnpm add abandoned-lib" output: "⚠️ CAUTION: abandoned-lib hasn't been updated in 2 years. Low community support. Consider alternatives."
metadata: priority: high version: 1.0
npm install some-package
Analysis Output:
🔍 Analyzing some-package...
📊 Package Analysis Results:
✅ Maintenance: Excellent (Last release: 15 days ago)
✅ Popularity: High (500k weekly downloads)
✅ Security: Clean (No vulnerabilities)
⭐ GitHub: 2.3k stars
💡 Recommendation: Great choice! This package is well-maintained and secure.
npm install old-vulnerable-package
Analysis Output:
🚨 WARNING: old-vulnerable-package Analysis
❌ Maintenance: Poor (Last release: 400 days ago)
❌ Popularity: Low (100 weekly downloads)
❌ Security: Critical (5 vulnerabilities detected)
⭐ GitHub: 50 stars
⚠️ Recommendations:
- Package is poorly maintained and has security issues
- Consider alternatives: modern-alternative, secure-package
- If you must use this package, update to latest version
- Monitor for security patches
# Analyze all current dependencies
npm audit
Enhanced Output:
🔍 Dependency Health Check
📦 Total Dependencies: 45
✅ Well-maintained: 38 packages
⚠️ Needs attention: 5 packages
🚨 Critical issues: 2 packages
📊 Summary:
- Average maintenance score: 85/100
- Average popularity score: 78/100
- Security vulnerabilities: 3 found
💡 Action Items:
1. Update lodash to fix security vulnerability
2. Replace deprecated-package with modern-alternative
3. Monitor old-package for updates
npm install and npm auditnpm outdated for update recommendationsyarn add and yarn auditpnpm add and pnpm auditbun add and bun audit