---
name: dependency-diet
description: "Applies “Every dependency is a hire” as a repeatable product-quality gate. Use during architecture work when each package is code you now maintain but didn't write — interview it first."
---

# Every dependency is a hire

Apply this skill during **Architecture** work. It supports Any stack.

Each package is code you now maintain but didn't write — interview it first.

## Instructions

Treat every dependency as a hire: it joins your codebase, ships its bugs with your name on them, and must be managed. Before adding one, answer in writing: what job does it do, why not the platform or ~50 lines of our own code, is it maintained (recent releases, open issue triage, more than one maintainer), and what's the license? Never carry two packages doing the same job. Commit the lockfile and treat upgrades as scheduled work with a changelog read — not an accident of reinstalling. For each significant dep, know the exit: what breaks if it's abandoned and what would replace it. When an agent proposes adding a package, the default answer is no until the justification exists.

## Detect the problem

- left-pad energy: a dep for 5 lines
- Two date libraries in one lockfile
- npm install as the first response to any problem

## Hold the gate

Do not declare this phase complete until every item passes:

- [ ] Every dependency justified by name and job; no two deps doing the same job
- [ ] Lockfile committed; upgrades are scheduled work, not vibes
- [ ] Anything you could write in ~50 lines is written, not installed
- [ ] License + maintenance health checked before adopting (last release, issues, bus factor)
- [ ] The removal path is known: what breaks and what replaces it if this dep dies

## Verify the result

Read the lockfile diff on every PR — a new dependency without written justification fails review.