deps

스타11

포크1

업데이트2026년 4월 25일 08:34

Use when adding a crate, updating dependency versions, auditing licenses, scanning for vulnerabilities, or editing `Cargo.toml` / `deny.toml` / `.licenserc.toml` in the OCX project.

설치

Codex 또는 Claude로 설치 이 Prompt를 복사해 Codex, Claude 또는 다른 어시스턴트에 붙여 넣으면 Skill 페이지를 검토하고 설치를 진행할 수 있습니다.

출처

ocx-sh

ocx-sh/ocx

GitHub 저장소 열기 Creator 저장소 보기

다운로드

Dependency Management

Role: add, update, audit Rust crate deps with license + advisory compliance.

Workflow

Research — query current crate APIs + feature flags via Context7 MCP before eval
Check license — cargo deny check licenses against OCX allowlist
Check advisories — cargo deny check advisories — no known vulns
Add — prefer workspace deps for shared crates
Verify — task license:deps + cargo clippy --workspace
Update — cargo update + cargo deny check + task verify

Relevant Rules (load explicitly for planning)

.claude/rules/subsystem-deps.md — tooling, license allowlist, SPDX header format, workspace deps, bans/sources policy, patched oci-client submodule (auto-loads on Cargo.toml / deny.toml / .licenserc.toml)
.claude/rules/quality-core.md — YAGNI on deps: minimize surface area
.claude/rules/quality-rust.md — Rust quality gates triggered by new deps

Qualitative Evaluation Criteria

Before recommend crate, assess:

Maintenance: last commit, last release, issue/PR response time, CI health
Bus factor: single maintainer vs community; check contributor graph
Maturity: version ≥1.0, API churn last 6 months, deprecation notices
Adoption: GitHub stars absolute AND relative to alternatives in niche
Ecosystem fit: works with tokio, our error model, license compatible
Alternatives: #1, #2, or #4 crate in space? What blessed.rs or lib.rs recommend?

Never pick between two crates from memory alone — query Context7 + check GitHub/crates.io same session.

Tool Preferences

Context7 MCP (mcp__context7__resolve-library-id + get-library-docs) — current API shape for fast-moving crates (tokio, oci-client, clap, serde). Fallback: WebFetch of docs.rs/<crate>. Never pick between two crates from memory alone.
task runner — task license:deps, task license:check, task license:format, task verify
cargo machete — detect unused crate deps (review before remove)

Constraints

NO add crate without license + advisory check
NO invent feature — prefer existing crate or stdlib
ALWAYS add shared deps to [workspace.dependencies], not per-crate
ALWAYS use chore(deps): commit prefix for dep updates
Submodule changes (external/rust-oci-client) need upstream PRs

Handoff

To Security Auditor — new attack surface from dep
To Builder — integration work

$ARGUMENTS

이 저장소의 다른 Skills

같은 저장소

review-surface

ocx-sh/ocx

Use when a diff or PR is too big to review by eye and the question is "what should I actually look at" — sorts each changed line into wire / CLI / API / logic / test / doc tiers, then opens a clickable local page with the real hunks. A reading order, never a verdict.

2026-07-2611

swarm-execute

ocx-sh/ocx

Use to implement a plan artifact from `/swarm-plan`, or a free-text implementation task with contract-first TDD + Review-Fix Loop. Tier (`low | auto | high | max`) scales builder model, loop rounds, review breadth, and Codex code-diff gate.

2026-07-2511

swarm-review

ocx-sh/ocx

Use for branch, PR, or diff review before landing on main. Tier (`low | auto | high | max`) scales breadth from single reviewer to adversarial panel with architect + SOTA-gap + Codex cross-model gate. Triggers: "review", "/swarm-review", pre-merge checks.

2026-07-2511

commit

ocx-sh/ocx

Use when the user says "commit", "/commit", "save progress", or asks to land working changes on a feature or worktree branch. OCX working-phase posture — minimises commit count, can amend rolling Checkpoints, offers a one-time PR prompt. For pre-merge cleanup, use `/finalize`.

2026-07-2111

swarm-plan

ocx-sh/ocx

Use for feature planning, task decomposition, multi-perspective research, or ADR scaffolding. Tier (`low | auto | high | max`) scales research depth, architect model, and review breadth. Canonical research primitive for AI config / ADR work.

2026-07-1711

codex-adversary

ocx-sh/ocx

Use when the user says "codex review", "/codex-adversary", "adversarial review", "cross-model review", or asks for a different-model second opinion on a diff or plan artifact. Complements `/swarm-review` via Codex-CLI. Scopes: code-diff (default), plan-artifact (gate for `/swarm-plan`).

2026-07-1611

Dependency Management

Role: add, update, audit Rust crate deps with license + advisory compliance.

Workflow

Research — query current crate APIs + feature flags via Context7 MCP before eval

Check license — cargo deny check licenses against OCX allowlist

Check advisories — cargo deny check advisories — no known vulns

Add — prefer workspace deps for shared crates

Verify — task license:deps + cargo clippy --workspace

Update — cargo update + cargo deny check + task verify

Relevant Rules (load explicitly for planning)

.claude/rules/subsystem-deps.md — tooling, license allowlist, SPDX header format, workspace deps, bans/sources policy, patched oci-client submodule (auto-loads on Cargo.toml / deny.toml / .licenserc.toml)

.claude/rules/quality-core.md — YAGNI on deps: minimize surface area

.claude/rules/quality-rust.md — Rust quality gates triggered by new deps

Qualitative Evaluation Criteria

Before recommend crate, assess:

Maintenance: last commit, last release, issue/PR response time, CI health

Bus factor: single maintainer vs community; check contributor graph

Maturity: version ≥1.0, API churn last 6 months, deprecation notices

Adoption: GitHub stars absolute AND relative to alternatives in niche

Ecosystem fit: works with tokio, our error model, license compatible

Alternatives: #1, #2, or #4 crate in space? What blessed.rs or lib.rs recommend?

Never pick between two crates from memory alone — query Context7 + check GitHub/crates.io same session.

Tool Preferences

Context7 MCP (mcp__context7__resolve-library-id + get-library-docs) — current API shape for fast-moving crates (tokio, oci-client, clap, serde). Fallback: WebFetch of docs.rs/<crate>. Never pick between two crates from memory alone.

task runner — task license:deps, task license:check, task license:format, task verify

cargo machete — detect unused crate deps (review before remove)

Constraints

NO add crate without license + advisory check

NO invent feature — prefer existing crate or stdlib

ALWAYS add shared deps to [workspace.dependencies], not per-crate

ALWAYS use chore(deps): commit prefix for dep updates

Submodule changes (external/rust-oci-client) need upstream PRs

Handoff

To Security Auditor — new attack surface from dep

To Builder — integration work

$ARGUMENTS

name	deps
description	Use when adding a crate, updating dependency versions, auditing licenses, scanning for vulnerabilities, or editing `Cargo.toml` / `deny.toml` / `.licenserc.toml` in the OCX project.