Not in the top 1,000 by GitHub stars
andrew/managing-dependencies
Claude Code skill for evaluating packages and managing dependencies securely
History
Review weekly changes to SKILL.md before updating. Dates mark the weeks in which we observed each version; checks apply to the recorded commits.
View weekly changes
skills/managing-dependencies/SKILL.md
Week of Nov 2, 2026 · Line counts unavailable
Before Not checked yet → After Network or broad shell
First observation → e6c13bd7246f
No earlier version was observed for comparison.
View on GitHubAdd to my skills
Verified commit e6c13bd7246f13bab6510790ca6378e8660bf50f
git clone --filter=blob:none --no-checkout https://github.com/andrew/managing-dependencies.git .hotskills/andrew-managing-dependencies && git -C .hotskills/andrew-managing-dependencies checkout --detach e6c13bd7246f13bab6510790ca6378e8660bf50f
# Copy each selected skill directory from .hotskills/andrew-managing-dependencies into .claude/skills/<skill-name>/15GitHub stars
0stars in 7 days
1skill in this repository
0commits in 30 days
Heat
0.3- Star growth, last 7 daysNot available
- Star growth, last 24 hoursNot available
- Rank movement, last 7 daysNot available
- Commits, last 30 daysNot available
- Accounts asking about it through MCP, last 7 daysNot available
- Hot votes this weekNot available
Heat never changes the order by stars, and sponsorship never touches it. How heat works
Stars over time
30-day change not yet available: not enough history.
Individual skills in this repository
- managing-dependencies
skills/managing-dependencies
How it works
managing-dependencies
When your agent uses it
Evaluates packages, manages dependencies, and addresses supply chain security. Use when adding npm/pip/cargo/bundler/go dependencies, auditing packages, reviewing lockfile changes, checking for vulnerabilities, comparing package alternatives, or assessing package trustworthiness.
What it loads into context
Frontmatter
101 tokensAlways available to the agent
SKILL.md
3,330 tokensWhen the skill is activated
Reference documents
0 tokensLoaded on request
Token counts are estimates. Scripts run separately; they are not counted as reference context.
The playbook
- Before Adding a Dependency
- Evaluating a Package
- Typosquatting Patterns
- AI-Suggested Packages (Slopsquatting)
- Dependency Confusion
- Provenance and Attestation
- Version Constraints
- Lockfiles
- Security Audits
- When Vulnerability Has No Patch
- Vendoring
- Check Licenses
- Install Scripts
- GitHub Actions
- Automated Updates
- ecosyste.ms
- OpenSSF Scorecard API
- deps.dev API
Files
../../.claude-plugin/marketplace.jsonasset797 bytes../../.claude-plugin/plugin.jsonasset158 bytesSKILL.mdcore13,303 bytesSKILL.mdcore13,303 bytesSKILL.mdcore13,303 bytesSKILL.mdcore13,303 bytesSKILL.mdcore13,303 bytesSKILL.mdcore13,303 bytesSKILL.mdcore13,303 bytesSKILL.mdcore13,303 bytesSKILL.mdcore13,303 bytesSKILL.mdcore13,303 bytesSKILL.mdcore13,303 bytesSKILL.mdcore13,303 bytesSKILL.mdcore13,303 bytesSKILL.mdcore13,303 bytesSKILL.mdcore13,303 bytesSKILL.mdcore13,303 bytesSKILL.mdcore13,303 bytesSKILL.mdcore13,303 bytes
Read SKILL.md
# Package Management
**Before suggesting any package, verify it exists on the registry.** Check that the name, maintainer, and purpose match expectations. Do not hallucinate package names.
**Decline to:**
- Suggest a package that cannot be verified to exist
- Add a dependency when stdlib provides equivalent functionality
- Run install scripts without explicit user approval
- Auto-merge updates that violate the safety criteria below
**If verification fails** (registry unreachable, metadata incomplete, provenance missing), default to refusal and explain why.
## Before Adding a Dependency
Skills included
- managing-dependencies
Repository facts
- License
- CC0-1.0
- Created
- Jan 21, 2026
- Last pushed
- Mar 8, 2026
- Forks
- 0
- Open issues
- 0
- Project activity
- Slowing
Before you install
Network or broad shellAutomated signals, not a guarantee
Checked Nov 5, 2026
Not fully analyzed: some files were too long, unreadable or missing. This never lowers the level.
Show 17 notes
skills/managing-dependencies/SKILL.md:1Analysis incomplete: Referenced executable target unavailable; not analyzedskills/managing-dependencies/SKILL.md:1Analysis incomplete: Referenced executable target unavailable; not analyzedskills/managing-dependencies/SKILL.md:1Analysis incomplete: Referenced executable target unavailable; not analyzedskills/managing-dependencies/SKILL.md:1Analysis incomplete: Referenced executable target unavailable; not analyzedskills/managing-dependencies/SKILL.md:1Analysis incomplete: Referenced executable target unavailable; not analyzedskills/managing-dependencies/SKILL.md:1Analysis incomplete: Referenced executable target unavailable; not analyzedskills/managing-dependencies/SKILL.md:1Analysis incomplete: Referenced executable target unavailable; not analyzedskills/managing-dependencies/SKILL.md:1Analysis incomplete: Referenced executable target unavailable; not analyzedskills/managing-dependencies/SKILL.md:1Analysis incomplete: Referenced executable target unavailable; not analyzedskills/managing-dependencies/SKILL.md:1Analysis incomplete: Referenced executable target unavailable; not analyzedskills/managing-dependencies/SKILL.md:1Analysis incomplete: Referenced executable target unavailable; not analyzedskills/managing-dependencies/SKILL.md:1Analysis incomplete: Referenced executable target unavailable; not analyzedskills/managing-dependencies/SKILL.md:1Analysis incomplete: Referenced executable target unavailable; not analyzedskills/managing-dependencies/SKILL.md:1Analysis incomplete: Referenced executable target unavailable; not analyzedskills/managing-dependencies/SKILL.md:1Analysis incomplete: Referenced executable target unavailable; not analyzedskills/managing-dependencies/SKILL.md:1Analysis incomplete: Referenced executable target unavailable; not analyzedskills/managing-dependencies/SKILL.md:1Analysis incomplete: Referenced executable target unavailable; not analyzed
- No broad tool permissions
- 5 dangerous shell commandsin 1 file: managing-dependencies/SKILL.md:206
- 23 network referencesin 2 files: managing-dependencies/SKILL.md:41 .claude-plugin/marketplace.json:1
- No hidden or obfuscated text
- No instruction overrides
- No executable scripts
- No access to secrets
- No requests to vote in Hot
Show all 28 signals by file
.claude-plugin/marketplace.json
- Network accessline 1
{ "$schema": "https://code.claude.com/schemas/marketplace.json", - Network accessline 2
"$schema": "https://code.claude.com/schemas/marketplace.json", - Network accessline 17
}, "license": "CC0-1.0", "repository": "https://github.com/andrew/managing-dependencies", - Network accessline 18
"license": "CC0-1.0", "repository": "https://github.com/andrew/managing-dependencies", "homepage": "https://github.com/andrew/managing-dependencies", - Network accessline 19
"repository": "https://github.com/andrew/managing-dependencies", - Network accessline 20
"homepage": "https://github.com/andrew/managing-dependencies",
skills/managing-dependencies/SKILL.md
- Network accessline 41
# Any ecosystem via ecosyste.ms curl -s "https://packages.ecosyste.ms/api/v1/registries/<registry>/packages/<package>" | jq '{ - Network accessline 42
curl -s "https://packages.ecosyste.ms/api/v1/registries/<registry>/packages/<package>" | jq '{ - Network accessline 82
scorecard --repo=github.com/owner/repo # Or visit: https://securityscorecards.dev - Network accessline 83
# Or visit: https://securityscorecards.dev - Network accessline 125
# Configure scope to route to private registry # .npmrc @yourcompany:registry=https://your-internal-registry.com - Network accessline 127
@yourcompany:registry=https://your-internal-registry.com - Network accessline 132
# Correct - private registry checked first pip install --index-url https://private.example.com/simple \ - Network accessline 133
pip install --index-url https://private.example.com/simple \ - Network accessline 134
--extra-index-url https://pypi.org/simple \ - Network accessline 148
# PyPI - check for Sigstore attestation curl -s "https://pypi.org/pypi/<package>/json" | jq '.urls[0].digests' - Network accessline 149
curl -s "https://pypi.org/pypi/<package>/json" | jq '.urls[0].digests' - Dangerous shell operationline 206
rm package-lock.json && npm install - Dangerous shell operationline 209
rm Gemfile.lock && bundle install - Dangerous shell operationline 212
rm Cargo.lock && cargo generate-lockfile - Dangerous shell operationline 215
rm poetry.lock && poetry lock - Dangerous shell operationline 218
rm uv.lock && uv lock - Network accessline 377
curl -s "https://packages.ecosyste.ms/api/v1/registries/<registry>/packages/<package>" | jq - Network accessline 405
curl -s "https://api.scorecard.dev/projects/github.com/<owner>/<repo>" | jq '{ - Network accessline 413
Human-readable: `https://ossf.github.io/scorecard-visualizer/#/projects/github.com/<owner>/<repo>` - Network accessline 420
curl -s "https://api.deps.dev/v3/systems/<ecosystem>/packages/<package>" | jq - Network accessline 429
- **Repository:** https://github.com/andrew/managing-dependencies - Network accessline 430
- **Author:** Andrew Nesbitt (https://nesbitt.io)
How the signals fit together
Facts from a static read of the files at the pinned commit. They describe what the code does, not why.
Some files could not be read; the facts below still hold.
Signal confidence: 22 facts
- Network access in code of the SKILL.mdmanaging-dependencies/SKILL.md:41High confidence
- Network access in code of the SKILL.mdmanaging-dependencies/SKILL.md:42High confidence
- Network access in code of the SKILL.mdmanaging-dependencies/SKILL.md:82High confidence
- Network access in code of the SKILL.mdmanaging-dependencies/SKILL.md:83High confidence
- Network access in code of the SKILL.mdmanaging-dependencies/SKILL.md:125High confidence
- Network access in code of the SKILL.mdmanaging-dependencies/SKILL.md:127High confidence
- Network access in code of the SKILL.mdmanaging-dependencies/SKILL.md:132High confidence
- Network access in code of the SKILL.mdmanaging-dependencies/SKILL.md:133High confidence
- Network access in code of the SKILL.mdmanaging-dependencies/SKILL.md:134High confidence
- Network access in code of the SKILL.mdmanaging-dependencies/SKILL.md:148High confidence
- Network access in code of the SKILL.mdmanaging-dependencies/SKILL.md:149High confidence
- Dangerous shell operation in code of the SKILL.mdmanaging-dependencies/SKILL.md:206High confidence
- Dangerous shell operation in code of the SKILL.mdmanaging-dependencies/SKILL.md:209High confidence
- Dangerous shell operation in code of the SKILL.mdmanaging-dependencies/SKILL.md:212High confidence
- Dangerous shell operation in code of the SKILL.mdmanaging-dependencies/SKILL.md:215High confidence
- Dangerous shell operation in code of the SKILL.mdmanaging-dependencies/SKILL.md:218High confidence
- Network access in code of the SKILL.mdmanaging-dependencies/SKILL.md:377High confidence
- Network access in code of the SKILL.mdmanaging-dependencies/SKILL.md:405High confidence
- Network access in prose of the SKILL.mdmanaging-dependencies/SKILL.md:413Low confidence
- Network access in code of the SKILL.mdmanaging-dependencies/SKILL.md:420High confidence
- Network access in prose of the SKILL.mdmanaging-dependencies/SKILL.md:429Low confidence
- Network access in prose of the SKILL.mdmanaging-dependencies/SKILL.md:430Low confidence
Works with
| Agent | Status | Evidence | Install to |
|---|---|---|---|
| Claude Code | Native | Manifest .claude-plugin/marketplace.json | .claude/skills/<skill-name>/ |
| Codex | Compatible | Standard SKILL.md skills/managing-dependencies/SKILL.md | .agents/skills/<skill-name>/ |
| Cursor | Compatible | Standard SKILL.md skills/managing-dependencies/SKILL.md | .cursor/skills/<skill-name>/ |
| Gemini CLI | Compatible | Standard SKILL.md skills/managing-dependencies/SKILL.md | .gemini/skills/<skill-name>/ |
| GitHub Copilot | Compatible | Standard SKILL.md skills/managing-dependencies/SKILL.md | .github/skills/<skill-name>/ |
| OpenCode | Compatible | Standard SKILL.md skills/managing-dependencies/SKILL.md | .opencode/skills/<skill-name>/ |
- Native The repository ships a manifest, folder or frontmatter field for this agent.
- Compatible A standard SKILL.md that this agent can read.
- Unknown No evidence either way.
Derived automatically from paths, manifests and frontmatter. Not tested on each agent.
