Individual skill

bom-slimmer

Reviews a codebase's direct dependencies and designs lightweight, low-risk, zero-dependency custom replacements using cdxgen SBOM evidence, occurrence/callstack usage data, and license and supply-chain risk evaluation. Use when asked to shrink node_modules, reduce dependency bloat or copyleft exposure, find small or utility packages that could be replaced with built-in code, or replace utility packages with native or built-in implementations. Load it before suggesting any command for that analysis, even when the user only wants to see the commands.

agent-plugin/skills/bom-slimmer/SKILL.md

Read pinned source

Source commit b0994ca9e4549ac8f3a50ed46afe78580f02c1a0

What was checked

Matches the observed repository HEAD: Yes
Scanner rules are current: Yes
Repository scan complete: No
Skill scan complete: No
Observed behavior: Network or broad shell
Last checked: Nov 3, 2026

These are observations at the recorded commit, not a guarantee of safety. Review the source before running it.

Install this skill

Choose an agent in your Stack or copy a command below. Commands fetch the pinned commit and copy only this skill directory. Existing destinations are refused. Copying a command does not install anything.

An install command is unavailable: current rules, complete repository and skill scans, an eligible behavior level and a permitted license are required.

Repository context

Repository stars (not skill ratings): 1,106
Repository last updated: Nov 7, 2026
License: Apache-2.0

Observed agent integration: No specific integration evidence. Standard SKILL.md installation does not imply verified compatibility.

bom Repository topic
sca Repository topic
cyclonedx Repository topic
sbom Repository topic
docker Repository topic
oci Repository topic
containers Repository topic
owasp Repository topic
package-url Repository topic
purl Repository topic
data Derived category

Files and excerpt

File metadata and permitted, redacted excerpts come from the recorded scan. Source links are pinned to that commit.

Browse files

SKILL.mdcore · 6,515 bytes
SKILL.mdcore · 6,515 bytes
SKILL.mdcore · 6,515 bytes

Read excerpt


# Skill: BOM Slimmer

This skill guides a local LLM through analyzing a project's direct dependencies, identifying high-overhead packages, and designing low-risk, zero-dependency custom replacements.

---

## 1. Using cdxgen SBOM as the Authoritative Data Source

A CycloneDX SBOM generated by `cdxgen` (`bom.json`) provides a complete, normalized, and machine-readable inventory of all direct and transitive dependencies. Use it as your primary source of truth:

1. **Locate Direct Dependencies**:
   Look under `bom.metadata.component` (the parent package) and trace its relationships in the `dependencies` array.
2. **Trace Dependency Trees**:
   Find the `dependencies` block at the root of the SBOM. Each entry maps a package `ref` to its direct dependency `dependsOn` refs: