evaluate-dependency
Installation
SKILL.md
Evaluate Dependency
Dual-purpose: upfront selection when adding a new dep, and review when a PR adds or bumps one. Same evaluation criteria either way, with per-language addenda for ecosystem-specific quirks.
When to use
| Mode | Triggers |
|---|---|
| Selection | Considering adding a dep, asks "should I use X", compares alternatives, before go get / npm install / pip install / cargo add |
| Review | PR diff touches a manifest, or review-security / review-code sees a new dep in scope |
Language-specific quirks (read first)
The canonical package coordinate usually has ecosystem-specific gotchas that override the general criteria. The wrong coordinate is the wrong dep, no matter how good the package is.
- Go: references/go.md. Semantic import versioning (
/v2,/v3paths),+incompatiblesmell,pkg.go.dev/vuln.go.dev,govulncheck. - Other ecosystems: not yet covered here. Run the general checklist and flag uncertainty about the canonical coordinate with
unsure:(perterse-output) rather than guessing.
Future addenda: npm (scoped vs unscoped, deprecated packages, ESM/CJS), Python (package vs distribution name, wheel/sdist, ABI compatibility), Rust (pre-1.0 churn, crate renames), Ruby (transitive native-extension hazards). Add when a real evaluation surfaces the need.