dep-egress — Dependency Egress Audit

Trigger: Use this skill when the question is what does this dependency send, and to whom:

• "Is it safe to add [package]?" / "does [package] phone home?"
• "What telemetry is in our dependencies?"
• "Audit [package] before I install it"
• "Does anything in node_modules call out to the network?"
• A dependency was just recommended and the user wants it checked before adopting

Do NOT activate for:

• Vulnerability scanning (CVEs, injection, hardcoded secrets) — that is a security review, a different job
• Regulatory compliance (GDPR, CCPA, HIPAA) — that asks whether your handling is lawful, not what a dependency emits
• Threat modeling your own architecture (STRIDE, LINDDUN)
• Picking between candidate libraries on quality grounds — that is capability discovery
• License compatibility questions

This skill answers one question: what leaves the machine because this package is installed.