dependency-guard

Mechanically prevent agents from introducing unvetted, unprompted, or banned dependencies into package.json manifests by comparing working tree changes…

Skill by ALTEN-group

IndexedMIT★ 5

Write a review

Install

Works with Claude Code, Claude apps, Codex, Cursor, Gemini CLI, GitHub Copilot, VS Code, OpenCode, Goose, Windsurf. Read the repository before you give any tool access to your data.

npx agentmarket install skill/alten-group-dependency-guard

Asks which of your tools to add it to (Claude Code, Codex, Cursor, VS Code, Windsurf, Gemini CLI, Claude Desktop) and shows the change first. See https://agentmart.dev/cli.

Get the weekly diff

The weekly diff: one email a week with new agent tools, notable updates and grade changes, plus security alerts for tools you follow. Double opt-in, one-click unsubscribe.

About

Mechanically prevent agents from introducing unvetted, unprompted, or banned dependencies into package.json manifests by comparing working tree changes against git HEAD.

Reviews

Write a review

No reviews yet. Installed it? Reviews come from verified installers only. How reviews work

Permissions

What this skill can do and what it asks for, from its SKILL.md. Checked Oct 25, 2026.

Tools: No tools found
Secrets: None asked for
Install scripts: None found
Runs as: Node.js package

Network hosts it talks to 1

codeload.github.com · found in install command

Files it touches

~/.claude/skills/dependency-guard

What's inside

Skill name: dependency-guard
Description: Mechanically prevent agents from introducing unvetted, unprompted, or banned dependencies into package.json manifests by comparing working tree changes against git HEAD.
License: MIT
Instructions: 41 lines in SKILL.md · view on GitHub

Before installing

Ships executable scripts

Files (4)

SKILL.md
dependency-contract.md · references/
dependency-guard.mjs · scripts/
dependency-guard.test.mjs · scripts/

SKILL.md (first lines)

# Dependency Guard

Blast-radius control for project dependencies, preventing unapproved package bloat and banned libraries.

## When to Use This Skill

- An AI agent edits `package.json` to install or modify dependencies.
- A project enforces a zero-new-dependencies policy unless explicitly requested by the user.
- A team wants to enforce bans on bloated or deprecated libraries (`moment`, `request`).

## Path resolution

Resolve `references/` and `scripts/` relative to **this skill's install directory** (e.g. `.agents/skills/dependency-guard/` or `.claude/skills/dependency-guard/`).

## Workflow

1. Read `references/dependency-contract.md` to review allowed vs. banned criteria.
2. Run the dependency guard against git changes:

```bash
# Check git working tree changes against HEAD (or pass --base <git-ref>, e.g. origin/main)
node scripts/dependency-guard.mjs --git
node scripts/dependency-guard.mjs --git --base origin/main

# Allow specific user-authorized new packages
node scripts/dependency-guard.mjs --git --allow "zod,dotenv"

# Run with JSON output for automated agent ingestion
node scripts/dependency-guard.mjs --git --json
```

3. If the guard detects unauthorized packages:
   - Remove the package from `package.json`.
   - Implement the feature using native language runtime utilities or existing packages.
   - Re-run until the command exits with code 0.

## Done When

- `scripts/dependency-guard.mjs` exits with code 0.
- Zero unauthorized or banned packages are introduced.

From ALTEN-group/coding-pal, MIT.

Signals

Stars: 5
Forks: 0
Open issues: 0
Last commit (this folder): Sep 23, 2026 (1 month ago)

From GitHub (fetched Oct 24, 2026).

Details

License: MIT
Repository: github.com/ALTEN-group/coding-pal
Website: alten-group.github.io/coding-pal/
First seen: Oct 24, 2026
Last checked: Oct 24, 2026
Source: GitHub github-graphql

More from ALTEN-group

Cite this page

dependency-guard skill. Agent Mart. https://agentmart.dev/skills/alten-group-dependency-guard (last updated 2026-10-24)