Agent skill · software engineering · erichowens
dependency-management
Managing third-party dependencies — version pinning, security auditing, license compliance, update workflows, lockfile management, supply chain security. Activate on "npm audit", "dependabot",
Why this skill is useful
Provides domain-specific knowledge on dependency management practices and tools like npm audit and Dependabot that the AI wouldn't reliably generate on its own.
What it needs
Requires npm installed locally. About 7k tokens when loaded. Last updated 2026-07-14. 180 stars on the source repository.
What this skill does
Dependency Management Third-party dependencies are simultaneously the most powerful and most dangerous part of modern software. A single mismanaged dependency caused log4shell. Left-pad took down thousands of builds in 11 minutes. Supply chain attacks through dependency confusion hit major enterprises. This skill covers the full lifecycle: choosing, pinning, auditing, updating, and removing dependencies with production discipline. When to Use Use for: Deciding whether to add a new dependency Version pinning strategy (exact vs range vs lockfile-only) Setting up automated update workflows (Renovate, Dependabot) Security auditing with npm audit, pip audit, Snyk, Socket.dev License compliance scanning (MIT/Apache/GPL compatibility) Generating Software Bills of Materials (SBOM) Resolving peer dependency conflicts and npm overrides Responding to security advisories and CVEs Detecting typosquatting and dependency confusion attacks NOT for: Internal monorepo package management (use monorepo-management) Publishing your own packages to npm, PyPI, crates.io Package manager configuration beyond dependency management (workspace config, etc.) Vendoring and air-gapped environments (mention these exist but they're outside scope) --- Core Decision: Should I Add This Dependency? --- Version Pinning Strategy Semver Semantics Recap When to Use Each Strategy Where Reasoning ---------- ------- ----------- Exact pinning (1.2.3) Production apps Reproducible builds; lockfile provides flexibility Tilde (~1.2.3) Libraries you publish Patch safety; minor versions may break consumers Caret (^1.2.3) Dev tooling only Acceptable churn for formatters, linters Lockfile as truth All production npm ci, pip install --frozen, cargo build Never Anywhere Catastrophic: installs whatever is latest at build time Anti-Pattern: Caret in Production App Dependencies Novice: "I use ^ so I always get bug fixes automatically. …
How to use it
Reference it in AdaL, Claude Code, Cursor or any coding agent — nothing to install:
@skills erichowens/dependency-management