dependency-decision

Name: dependency-decision
Availability: InStock
Author: vovanostm-public

Evaluates proposed dependencies for necessity, security, license, and operational risk.

Updated Jun 8, 2026

Search Tags:#dependency management #security review #risk assessment #package evaluation #approval workflow #license compliance

Ready to run

npx skills add https://github.com/vovanostm-public/multica --skill dependency-decision-vovanostm-public

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: dependency-decision
Source: https://github.com/vovanostm-public/multica/tree/main/workflow-bundles/multica-specops-v5/codex_skills/.agents/skills/dependency-decision
Command: npx skills add https://github.com/vovanostm-public/multica --skill dependency-decision-vovanostm-public

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve? Teams often add new libraries, packages, or frameworks without a structured review, leading to bloated lockfiles, license violations, and unpatched security risks. This Skill enforces a consistent decision process before any dependency is approved. ## Core Features & Use Cases - Necessity Check: Verifies whether existing code, dependencies, or the standard library already solve the problem before approving anything new. - Risk Assessment: Evaluates maintenance status, popularity, license, security posture, transitive risk, and bundle/runtime impact. - Approval Gating: Classifies risk level and routes medium/high-risk additions to human or security review with a rollback plan. - Use Case: A developer proposes adding a new UI framework to the project. The Skill checks existing alternatives, audits the license and security posture, estimates bundle impact, and produces a typed decision record with an approval request. ## Quick Start Evaluate whether we should add the proposed package to the project and produce a dependency decision with risk classification and alternatives.

Frequently Asked Questions about dependency-decision

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I evaluate whether to add a new dependency to my project?▼

First check if existing code, dependencies, or the standard library solve the problem. Then evaluate maintenance activity, popularity, license, security posture, and transitive risk, estimate bundle and operational impact, and classify the risk level before approving.

What should a dependency review checklist include?▼

A dependency review should cover necessity versus existing alternatives, maintenance and popularity signals, license compatibility, known security vulnerabilities, transitive dependency risk, bundle or runtime size impact, and a rollback plan for the addition.

When does a new dependency require security or human approval?▼

Approval is required when the dependency has high impact or transitive risk, or when its security posture or license is unknown. Small dev-only tools can be allowed if scoped and documented, while medium and high risk additions are blocked pending review.

Can I add a dependency if an existing package already solves the problem?▼

No. If an existing dependency or the standard library is sufficient, the decision process rejects the new dependency to avoid lockfile bloat and duplicated functionality.

What are the limitations of automated dependency decision checks?▼

The process relies on available evidence about maintenance, license, and security, so unknown or unverifiable signals result in a blocked decision rather than approval. It also does not execute privileged actions directly and must request the approved action pipeline.