Dependency Management

Scope note: whether a new dependency is warranted at all is ponytail's job (rung 5 — stdlib, native, and already-installed deps come first). This skill only applies once that gate has already been cleared.

Vetting: quick check always, deep vetting for security-sensitive deps

Every new dependency gets a fast sanity check before installing: last-published date, rough popularity (downloads/stars), whether it's actively maintained. This is a glance, not an investigation — catches obviously abandoned or sketchy packages for near-zero cost.

Security-sensitive dependencies — auth, crypto, payment handling, anything doing deserialization or FFI, anything in the direct path of warisskill-security-practices's baseline — get the full checklist: