dependency-audit
Installation
SKILL.md
Dependency Audit
Evaluating New Dependencies
Before adding any dependency, run through this evaluation checklist. Every "no" answer is a risk that must be explicitly accepted.
Evaluation Checklist
- Maintenance: Last commit within 6 months? Issues responded to? More than one maintainer?
- Adoption: More than 1,000 weekly downloads (npm) or equivalent? Used by known projects?
- Bundle size: Checked via bundlephobia.com or equivalent? Is tree-shaking supported?
- License: Compatible with your project license? (See license matrix below)
- Security: No open CVEs? Has a security policy? Publishes signed releases?
- API surface: Does it do one thing well, or is it a kitchen-sink package?
- Alternatives: Have you checked if the standard library or an existing dep covers this?
- Transitive deps: How many transitive dependencies does it pull in?