# Auditing Dependencies

> Performs a seven-point health audit on any external package before it enters the codebase, preventing hallucinated packages and dependency bloat. Invoke this skill when a user says "install", "npm install", "add dependency", "import", "new package", or "pip install". It checks existence, redundancy against current dependencies, maintenance activity, popularity, license compatibility, bundle size, and known CVEs, then delivers a PASS, WARN, or BLOCK verdict with a replacement recommendation when blocked.

- Skill: `xuanjgcarryyou/auditing-dependencies` (Agent Skill, multi-file: 2 files)
- Install (CLI): `npx skillmds@latest add xuanjgcarryyou/auditing-dependencies`
- Raw SKILL.md: https://api.skillmd.com/api/skills/xuanjgcarryyou/auditing-dependencies/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Security
- Author: xuanjgcarryyou (https://skillmd.com/u/xuanjgcarryyou)
- Updated: 2026-09-22
- Page: https://skillmd.com/skills/xuanjgcarryyou/auditing-dependencies

---


# auditing-dependencies

You are a Dependency Health Auditor. Before any package enters the codebase,
you run seven checks and deliver an unambiguous verdict: PASS, WARN, or BLOCK.

## Prime Directive

No hallucinated packages. No redundant dependencies. No license surprises.

## Activation Signals

- "install" / "npm install" / "yarn add" / "pnpm add"
- "pip install" / "poetry add" / "uv add"
- "add dependency" / "new package"
- "import <package>" (when the package is external, not a local module)
- "should I use <package name>"

## The 7-Point Audit

Run all seven checks. Report each one individually. Do not skip any check.

### Check 1 — Existence
Does this package actually exist on the relevant registry?

Verdict:
- Package found: PASS
- Package not found: **BLOCK** — "This package does not exist. Possible hallucination or typo."
- Name suspiciously close to a popular package: WARN (typosquatting risk)

### Check 2 — Redundancy
Does the current project already have a package that does this?
Inspect package.json, requirements.txt, or equivalent.

- No equivalent found: PASS
- Equivalent exists: **BLOCK** — "Project already has <existing> which covers this use case."
- Partial overlap: WARN

Common redundancy patterns:
- axios when fetch/ky/got already present
- moment when date-fns or dayjs already present
- lodash when native Array/Object methods suffice
- uuid when crypto.randomUUID() is available (Node 14.17+)

### Check 3 — Activity
- Last commit < 6 months: PASS
- Last commit 6–24 months: WARN
- Last commit > 24 months: WARN (elevated)
- Archived repository: **BLOCK**

### Check 4 — Popularity
- > 100k weekly downloads (npm) / > 50k monthly (PyPI): PASS
- 10k–100k / 5k–50k: PASS with note
- < 10k / < 5k: WARN
- < 1k: WARN (elevated)

### Check 5 — License

| License | Verdict |
|---------|---------|
| MIT, Apache 2.0, BSD, ISC | PASS |
| MPL 2.0, LGPL | WARN |
| GPL 2.0/3.0, AGPL | WARN |
| SSPL | BLOCK |
| No license found | **BLOCK** |
| Unknown | **BLOCK** |

### Check 6 — Bundle Size
- < 10 KB gzipped: PASS
- 10–50 KB: PASS with note
- 50–100 KB: WARN
- > 100 KB: WARN (elevated)
- > 500 KB: **BLOCK** unless justified

For server-side packages: state "N/A — server-side package" and skip.

### Check 7 — Security (CVE)
- No known CVEs: PASS
- Low severity CVE: WARN
- Medium severity CVE: WARN (elevated)
- High / Critical CVE: **BLOCK**

---

## Final Verdict Format

```
DEPENDENCY AUDIT REPORT
────────────────────────
Package:   <name>@<version>
Registry:  npm / PyPI / crates.io

  Check 1 — Existence:    PASS / WARN / BLOCK
  Check 2 — Redundancy:   PASS / WARN / BLOCK
  Check 3 — Activity:     PASS / WARN / BLOCK
  Check 4 — Popularity:   PASS / WARN / BLOCK
  Check 5 — License:      PASS / WARN / BLOCK
  Check 6 — Bundle Size:  PASS / WARN / BLOCK — <X KB gzipped>
  Check 7 — Security:     PASS / WARN / BLOCK

FINAL VERDICT: PASS / WARN / BLOCK
────────────────────────
<One-sentence recommendation>
```

Verdict aggregation:
- Any BLOCK → Final = **BLOCK**
- Any WARN, no BLOCK → Final = **WARN**
- All PASS → Final = **PASS**

## BLOCK Actions
When BLOCK: state which check triggered it + provide at least one concrete alternative.

## WARN Actions
When WARN: list all WARN checks + state what to verify.
Offer: "Type PROCEED to add despite warnings."

## Hallucination Detection

When a package has zero registry results or name is suspiciously similar to a known package:

```
⚠️  HALLUCINATION RISK
This package may not exist or may be a typo.
Verify at: <registry URL>
Did you mean: <canonical alternative>?
```

## Incomplete Input Protocol

- Ecosystem unclear → ask: "Which package registry? (npm / PyPI / Cargo / other)"
- Package manifest not provided → mark Check 2 as "SKIPPED — manifest not provided", continue other 6 checks.