Is the Managing Dependencies skill free?

Yes. The skill itself is free from andrew/managing-dependencies. SkillProof publishes the install command and an independent test verdict at no cost.

What is the Managing Dependencies SkillProof Score?

9.6/10 — installs cleanly 5/5, triggers reliably 5/5, output vs. baseline 9/10, docs & honesty 5/5.

How do I install Managing Dependencies?

Copy the install command from this page, run it in your terminal, and restart Claude Code. Skills live in ~/.claude/skills/ (global) or .claude/skills/ inside a project.

Can I use Managing Dependencies with Cursor, Copilot, Gemini CLI, Codex or other AI tools?

The SKILL.md format is native to Claude (Claude Code, Desktop, claude.ai). The instructions inside adapt to other assistants: Cursor rules, GitHub Copilot instructions, Windsurf rules, Custom GPTs, AGENTS.md for OpenAI Codex, and GEMINI.md for Google Gemini CLI — our conversion guides cover each, and the free converter on the tools page does the wrapping for you.

Managing Dependencies

Supply-chain checklist that verifies a package via real registry APIs before you add it, and pushes you to inline instead.

by andrew · andrew/managing-dependencies

Tested · Works

Install — copy the command Download source ↗

Test report

Verdict: Tested · Works
Score: 9.6/10
Tested: Jul 15, 2026
Environment: Claude Code 2.x (agent harness)
Upstream re-checked: Aug 10, 2026 · 2f7e0b4

Live-tested against a real package (is-promise): the skill's decision funnel pulled real ecosyste.ms metadata (347k dependent repos, MIT, 0 advisories, but no release since 2020) and correctly steered toward inlining a 1-line typeof check instead of installing — a materially better, evidence-backed call than the naive 'looks popular, go ahead' baseline.

Scored on four weighted criteria — install, triggering, output vs. baseline, docs. How scoring works

Installs cleanly 5/5
Triggers reliably 5/5
Output vs. baseline 9/10
Docs & honesty 5/5

What Managing Dependencies does

A reference/process skill for evaluating whether to add a dependency: checks stdlib-first, transitive cost, typosquatting/slopsquatting patterns, provenance and OpenSSF Scorecard, lockfile hygiene, and safe auto-merge rules, using live curl calls to ecosyste.ms, scorecard.dev, and deps.dev. Triggers when adding npm/pip/cargo/bundler/go dependencies, auditing packages, reviewing lockfile diffs, or comparing package alternatives.

How to install Managing Dependencies

git clone https://github.com/andrew/managing-dependencies
cd managing-dependencies
mkdir -p ~/.claude/skills
cp -r skills/managing-dependencies ~/.claude/skills/managing-dependencies

Skills live in ~/.claude/skills/ (global) or .claude/skills/ (per-project). Restart Claude Code after installing.

Commands — how to trigger Managing Dependencies

/managing-dependencies Supply-chain checklist that verifies a package via real registry APIs before you add it, and pushes you to inline instead.

It also activates on plain-language prompts like these:

Should I add is-promise as a dependency or just inline the check?
Audit this npm package for typosquatting risk before I install it
Check this package's OpenSSF Scorecard before we add it to the lockfile

Frequently asked questions

Is the Managing Dependencies skill free?: Yes. The skill itself is free from andrew/managing-dependencies. SkillProof publishes the install command and an independent test verdict at no cost.
Does Managing Dependencies work with Claude Code?: We tested it with Claude Code 2.x (agent harness) on Jul 15, 2026. Verdict: Tested · Works. Live-tested against a real package (is-promise): the skill's decision funnel pulled real ecosyste.ms metadata (347k dependent repos, MIT, 0 advisories, but no release since 2020) and correctly steered toward inlining a 1-line typeof check instead of installing — a materially better, evidence-backed call than the naive 'looks popular, go ahead' baseline.
What is the Managing Dependencies SkillProof Score?: 9.6/10 — installs cleanly 5/5, triggers reliably 5/5, output vs. baseline 9/10, docs & honesty 5/5.
How do I install Managing Dependencies?: Copy the install command from this page, run it in your terminal, and restart Claude Code. Skills live in ~/.claude/skills/ (global) or .claude/skills/ inside a project.
Can I use Managing Dependencies with Cursor, Copilot, Gemini CLI, Codex or other AI tools?: The SKILL.md format is native to Claude (Claude Code, Desktop, claude.ai). The instructions inside adapt to other assistants: Cursor rules, GitHub Copilot instructions, Windsurf rules, Custom GPTs, AGENTS.md for OpenAI Codex, and GEMINI.md for Google Gemini CLI — our conversion guides cover each, and the free converter on the tools page does the wrapping for you.