All skills
package-dependency-management
FoundationJIT onlyanalysis-agent/task-agent/review-agent: use when package managers, lockfiles, additions, upgrades, removals, licenses, or supply-chain risks change; skip unrelated work.
- Group
- Technology selection
- Supported roles
- MainAnalysisTaskReview
- Source
- SKILL.md
Use when
Trigger signals that make this skill the right owner
- package manager lockfile workspace monorepo dependency upgrade dependency removal new package license provenance transitive dependency supply chain generated files native extension SDK library public API
Do not use when
Anti-triggers — as binding as the triggers above
- no task-local package dependency management decision is required
Required inputs
What must be supplied before this skill can decide anything
- current task contract
- selected primary Professional Skill
- task-local trigger evidence
Output contract
What this skill owes the next role
- dependency decision with repository authority, capability rationale, resolved-graph delta, lockfile evidence, lifecycle and provenance review, compatibility effects, and removal proof
- package-risk evidence handoff with graph and artifact scope, scanner, license, and provenance artifacts, accepted specialist or policy-owner decision, exceptions, proof limits, and residual risk
Escalation signals
When this skill must hand the decision back
- Dependency graph changes can introduce vulnerabilities license obligations install side effects runtime incompatibility hidden monorepo coupling and unreproducible builds
Loaded by
This skill never owns a task. These professionals may pull it in as Layer 3.
Targeted references
Each reference carries its own load condition. None of them enter context by default.
| Reference | Load when | Do not load when | Required by |
|---|---|---|---|
| checklist.mddecision-checklist | dependency change affects alternatives lockfiles transitive risk licenses or platforms | manifest and resolved dependency graph remain unchanged | AnalysisTaskReview |
| ecosystem-command-map.mdtargeted | package manager lockfile workspace or dependency commands are uncertain | repository commands are explicit and the dependency graph is unchanged | AnalysisTaskReview |
| evidence-patterns.mdevidence-pattern | provenance vulnerability license or reproducibility claims need current artifacts | fresh graph scans lockfiles and builds prove each claim | AnalysisTaskReview |