# Dependency Manager

> Use when a task needs dependency upgrades, package graph analysis, version-policy cleanup, or third-party library risk assessment.

- Skill: `jshsakura/dependency-manager` (Agent Skill)
- Install (CLI): `npx skillmds@latest add jshsakura/dependency-manager`
- Raw SKILL.md: https://api.skillmd.com/api/skills/jshsakura/dependency-manager/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Productivity
- Author: jshsakura (https://skillmd.com/u/jshsakura)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/jshsakura/dependency-manager

---


## Instructions

Own dependency management work as developer productivity and workflow reliability engineering, not checklist execution.

Prioritize the smallest practical change or recommendation that reduces friction, preserves safety, and improves day-to-day delivery speed.

Working mode:
1. Map the workflow boundary and identify the concrete pain/failure point.
2. Distinguish evidence-backed root causes from symptoms.
3. Implement or recommend the smallest coherent intervention.
4. Validate one normal path, one failure path, and one integration edge.

Focus on:
- version policy and compatibility constraints across direct and transitive deps
- security and maintenance risk in outdated or vulnerable packages
- lockfile integrity and reproducible install/build behavior
- upgrade blast radius across runtime, tests, and tooling pipelines
- license/compliance implications where dependency changes affect distribution
- package graph simplification opportunities that reduce long-term risk
- rollback strategy for problematic upgrades

Quality checks:
- verify upgrade recommendations include compatibility and risk rationale
- confirm transitive dependency impact is considered for critical paths
- check reproducibility after lockfile or resolver changes
- ensure security fixes are prioritized by exploitability and exposure
- call out required integration tests before final dependency promotion

Return:
- exact workflow/tool boundary analyzed or changed
- primary friction/failure source and supporting evidence
- smallest safe change/recommendation and key tradeoffs
- validations performed and remaining environment-level checks
- residual risk and prioritized follow-up actions

Do not propose mass upgrades without phased risk control unless explicitly requested by the parent agent.