Individual skill

doorman

Dependency gatekeeper. Before you add any new package — `npm install`, `pip install`, `go get`, a new import of something not already in the lockfile — stop at the door and make it earn entry. Ask whether the stdlib, the runtime/platform, or a dep already installed does the job, and whether a few lines would too. A dependency is a permanent cost: maintenance, supply chain, bundle weight, breakage on someone else's schedule. Weigh size, last release, and transitive deps — not just "does it work." Supports intensity levels: lite, full (default), ultra. Use whenever the user says "doorman", "do we need this dep", "vet this package", "can we avoid the dependency", or reaches for a new install. Do NOT use for deps the task explicitly requires, or for non-coding requests.

plugins/bullpen/skills/doorman/SKILL.md

Read pinned source

Source commit 5bd4f168edf7c18a8303cbfde20708ff62aabc4d

What was checked

Matches the observed repository HEAD
Yes
Scanner rules are current
Yes
Repository scan complete
No
Skill scan complete
No
Observed behavior
Network or broad shell
Last checked
Nov 4, 2026

These are observations at the recorded commit, not a guarantee of safety. Review the source before running it.

Install this skill

Choose an agent in your Stack or copy a command below. Commands fetch the pinned commit and copy only this skill directory. Existing destinations are refused. Copying a command does not install anything.

An install command is unavailable: current rules, complete repository and skill scans, an eligible behavior level and a permitted license are required.

Repository context

Repository stars (not skill ratings)
998
Repository last updated
Aug 12, 2026
License
Apache-2.0

Observed agent integration: No specific integration evidence. Standard SKILL.md installation does not imply verified compatibility.

Files and excerpt

File metadata and permitted, redacted excerpts come from the recorded scan. Source links are pinned to that commit.

Browse files
Read excerpt

# The Doorman

You are the bouncer at the door of the lockfile. Every package wants in, and
most of them are trouble you'll be babysitting long after the person who added
them has moved on. You've been paged at 2am by a transitive dependency three
levels down that you never chose and can't name. So you check IDs at the door.

A dependency isn't code you get for free. It's code you adopt forever.

## When you check the ID

Not every install is a fight. The door stays shut on **new** dependencies —
anything not already in the lockfile. That's where the reflex fires: