[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M71V0VT3AY18MZGTDDD9AD4H":3,"skill-same:01M71V0VT3AY18MZGTDDD9AD4H":70},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":23,"publishedAt":36,"linkOnly":37,"markdownContent":38,"markdownBody":39,"frontMatter":40,"refName":43,"commitSha":44,"skillDirectory":45,"forksCount":46,"repositoryHtmlUrl":47,"repositoryHomepageUrl":6,"ownerHtmlUrl":48,"ownerBlogUrl":49,"ownerDescription":6,"updatedAt":50,"install":51,"resources":63},"01M71V0VT3AY18MZGTDDD9AD4H","review-deps",null,"Judge dependencies, advisories, and licences. Use as a required review, or as \u002Freview-deps. Not for how a dependency is called: review-code covers that.","cjohnhanson\u002Falmanac","cjohnhanson","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F9891457?v=4","01M71V0RKGDFGXX6HDG89T3WE5","Cody J. Hanson","01M71V0RM80Q8CT8YGTNE22AK2",1,"MIT","https:\u002F\u002Fgithub.com\u002Fcjohnhanson\u002Falmanac\u002Fblob\u002Fmain\u002F.agents\u002Fskills\u002Freview-deps\u002FSKILL.md",[18],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000030","开发工程师","PROFESSION","适用职业",[24,25,26,27,28,29,30,31,32,33,34,35],"deps","review","review deps","as","for","true","use","code","how","dependency","dependencies","judge","2026-11-10 13:02:02",false,"---\nname: review-deps\ndescription: >\n  Judge dependencies, advisories, and licences. Use as a required review,\n  or as \u002Freview-deps. Not for how a dependency is called: review-code\n  covers that.\nlicense: MIT\nuser-invocable: true\n---\n\n# Review: dependencies\n\nYou are one independent check on a change you did not write. Judge the\ndependencies. Read `signoff-driver` for the sign-off line, the two\nseverity bands, and the not-applicable case.\n\nA repository with no manifest and no external call is a real\nnot-applicable case. Search before you say so.\n\n## Method\n\nTwo questions, asked in order. Does this code need to exist? If it does,\nis this the thing everyone else uses?\n\nThe first is the library-first audit: hand-written code that reimplements\na solved problem carries the bugs the solved version already fixed. The\nsecond is a consensus test, judged from evidence rather than reputation.\n\nIf `library-first-eval` is installed, load it. Criterion 2 is its audit.\nMap its bands as `signoff-driver` states.\n\n## Criteria\n\n1. **Apply the consensus test to each new dependency.** Three\n   questions. Is it maintained, judged by commit history rather than by\n   its README? Is it widely used, judged by a count the ecosystem\n   publishes: downloads, dependents, or stars? Is it what practitioners in\n   this language reach for? A niche choice where a consensus one exists is\n   **minor** when the niche one is maintained and **blocking** when it\n   is not. Name the consensus alternative either way.\n\n2. **Find the reinvented wheel.** Read the change for code that solves a\n   solved problem by hand. A parser, a retry loop, a path normalizer, and\n   a date format are the common ones. Name the standard-library facility\n   or the widely used library that replaces it. **Blocking** for a\n   hand-rolled parser of a real format, because such a parser accepts\n   input it should reject. **Minor** for a short helper.\n\n3. **Check a stated rule about external programs.** Some repositories\n   require a single self-contained binary and forbid calling another\n   program. A repository may state such a rule in its agent-instruction\n   file, in its contributing guide, or in a test that enforces it. An\n   agent-instruction file is the file a coding agent reads on entering a\n   repository: AGENTS.md, CLAUDE.md, or the equivalent the repository\n   names. Where it does, a new call against the rule is\n   **blocking**. Where a\n   repository states no such rule, judge only whether the new requirement\n   is documented for installers: an undocumented one is\n   **minor**.\n\n   Check the indirect path too. A library that calls an external program\n   makes the caller do so.\n\n4. **Read the test that enforces the rule.** Where a repository has a\n   test asserting it spawns nothing, judge whether it would catch this\n   change. A test that inspects only its own source misses a spawn inside\n   a dependency. A gap here is **minor** on its own and\n   **blocking** when this change walks through it. Name the gap in the\n   test, not only the spawn.\n\n5. **Check advisories and the licence.** Look each dependency version\n   up with the ecosystem's audit tool: `cargo audit`, `pip-audit`, `npm\n   audit`, or the equivalent. Say which tool you ran. An advisory\n   affecting the version in use is **blocking**, and stays blocking unless\n   you show the affected path is unreachable and say how. Check the\n   licence against the repository's own: a copyleft dependency in a\n   permissive project is **blocking**.\n\n   This criterion owns every dependency fact, so one weak dependency\n   yields one finding and no other review repeats it.\n\n6. **Walk a fresh install.** Follow the repository's own install\n   instructions on a clean machine, or reason step by step where you\n   cannot. Name every step needing something the install does not carry. A\n   toolchain, a hand-written config file, an environment variable, and a\n   program on the path each count. A missing step is\n   **blocking** when\n   the tool fails without it, and **minor** when it degrades.\n\n## Worked examples\n\n### The spawn hides inside the library\n\nA change adds git operations to a tool whose documentation states it must\ncall no other program.\n\nA weak review sees a well-known git library in the manifest, confirms it\nis maintained and popular, and passes.\n\nThis skill reads how the library performs each operation. Its local-path\ntransport starts a helper program, and opening a repository without\nisolation runs a config command. The tool now depends on git being\ninstalled. The repository's own test misses it, because the call happens\ninside the dependency.\n\n    signoff[review-deps] FAIL 1895f0d blocking: the file:\u002F\u002F transport\n    spawns git-upload-pack against the stated rule, and the no-spawn\n    test inspects only this crate's own calls\n\n### A real dependency, cleared\n\nA change adds a date-handling library and deletes a hand-rolled parser.\n\n    signoff[review-deps] PASS 5b7e881 the added library is the\n    ecosystem's default by dependent count and its last release is six\n    weeks old; it replaces 40 lines of hand-rolled parsing that\n    mishandled a leap day; it starts no other program; a fresh install\n    is one command; minor: the changelog link in the manifest is dead\n\n### Nothing to judge, after looking\n\n    signoff[review-deps] PASS a594ad8 not applicable: no manifest and\n    no lockfile; grepped for subprocess and shell calls across nine\n    scripts and found only POSIX builtins; the documented install is\n    git clone and one command\n","# Review: dependencies\n\nYou are one independent check on a change you did not write. Judge the\ndependencies. Read `signoff-driver` for the sign-off line, the two\nseverity bands, and the not-applicable case.\n\nA repository with no manifest and no external call is a real\nnot-applicable case. Search before you say so.\n\n## Method\n\nTwo questions, asked in order. Does this code need to exist? If it does,\nis this the thing everyone else uses?\n\nThe first is the library-first audit: hand-written code that reimplements\na solved problem carries the bugs the solved version already fixed. The\nsecond is a consensus test, judged from evidence rather than reputation.\n\nIf `library-first-eval` is installed, load it. Criterion 2 is its audit.\nMap its bands as `signoff-driver` states.\n\n## Criteria\n\n1. **Apply the consensus test to each new dependency.** Three\n   questions. Is it maintained, judged by commit history rather than by\n   its README? Is it widely used, judged by a count the ecosystem\n   publishes: downloads, dependents, or stars? Is it what practitioners in\n   this language reach for? A niche choice where a consensus one exists is\n   **minor** when the niche one is maintained and **blocking** when it\n   is not. Name the consensus alternative either way.\n\n2. **Find the reinvented wheel.** Read the change for code that solves a\n   solved problem by hand. A parser, a retry loop, a path normalizer, and\n   a date format are the common ones. Name the standard-library facility\n   or the widely used library that replaces it. **Blocking** for a\n   hand-rolled parser of a real format, because such a parser accepts\n   input it should reject. **Minor** for a short helper.\n\n3. **Check a stated rule about external programs.** Some repositories\n   require a single self-contained binary and forbid calling another\n   program. A repository may state such a rule in its agent-instruction\n   file, in its contributing guide, or in a test that enforces it. An\n   agent-instruction file is the file a coding agent reads on entering a\n   repository: AGENTS.md, CLAUDE.md, or the equivalent the repository\n   names. Where it does, a new call against the rule is\n   **blocking**. Where a\n   repository states no such rule, judge only whether the new requirement\n   is documented for installers: an undocumented one is\n   **minor**.\n\n   Check the indirect path too. A library that calls an external program\n   makes the caller do so.\n\n4. **Read the test that enforces the rule.** Where a repository has a\n   test asserting it spawns nothing, judge whether it would catch this\n   change. A test that inspects only its own source misses a spawn inside\n   a dependency. A gap here is **minor** on its own and\n   **blocking** when this change walks through it. Name the gap in the\n   test, not only the spawn.\n\n5. **Check advisories and the licence.** Look each dependency version\n   up with the ecosystem's audit tool: `cargo audit`, `pip-audit`, `npm\n   audit`, or the equivalent. Say which tool you ran. An advisory\n   affecting the version in use is **blocking**, and stays blocking unless\n   you show the affected path is unreachable and say how. Check the\n   licence against the repository's own: a copyleft dependency in a\n   permissive project is **blocking**.\n\n   This criterion owns every dependency fact, so one weak dependency\n   yields one finding and no other review repeats it.\n\n6. **Walk a fresh install.** Follow the repository's own install\n   instructions on a clean machine, or reason step by step where you\n   cannot. Name every step needing something the install does not carry. A\n   toolchain, a hand-written config file, an environment variable, and a\n   program on the path each count. A missing step is\n   **blocking** when\n   the tool fails without it, and **minor** when it degrades.\n\n## Worked examples\n\n### The spawn hides inside the library\n\nA change adds git operations to a tool whose documentation states it must\ncall no other program.\n\nA weak review sees a well-known git library in the manifest, confirms it\nis maintained and popular, and passes.\n\nThis skill reads how the library performs each operation. Its local-path\ntransport starts a helper program, and opening a repository without\nisolation runs a config command. The tool now depends on git being\ninstalled. The repository's own test misses it, because the call happens\ninside the dependency.\n\n    signoff[review-deps] FAIL 1895f0d blocking: the file:\u002F\u002F transport\n    spawns git-upload-pack against the stated rule, and the no-spawn\n    test inspects only this crate's own calls\n\n### A real dependency, cleared\n\nA change adds a date-handling library and deletes a hand-rolled parser.\n\n    signoff[review-deps] PASS 5b7e881 the added library is the\n    ecosystem's default by dependent count and its last release is six\n    weeks old; it replaces 40 lines of hand-rolled parsing that\n    mishandled a leap day; it starts no other program; a fresh install\n    is one command; minor: the changelog link in the manifest is dead\n\n### Nothing to judge, after looking\n\n    signoff[review-deps] PASS a594ad8 not applicable: no manifest and\n    no lockfile; grepped for subprocess and shell calls across nine\n    scripts and found only POSIX builtins; the documented install is\n    git clone and one command\n",{"name":5,"license":15,"description":41,"user-invocable":42},"Judge dependencies, advisories, and licences. Use as a required review, or as \u002Freview-deps. Not for how a dependency is called: review-code covers that.\n",true,"main","e8ec4bbead8873e34b42939895cf6d9ee1e9e149",".agents\u002Fskills\u002Freview-deps",0,"https:\u002F\u002Fgithub.com\u002Fcjohnhanson\u002Falmanac","https:\u002F\u002Fgithub.com\u002Fcjohnhanson","http:\u002F\u002Fcodyjhanson.com","2026-11-09 23:42:11",{"source":8,"skillName":5,"commands":52,"prompt":62,"zipAvailable":42},[53,56,59],{"tool":54,"command":55},"npx","npx skills add cjohnhanson\u002Falmanac --skill review-deps",{"tool":57,"command":58},"bunx","bunx skills add cjohnhanson\u002Falmanac --skill review-deps",{"tool":60,"command":61},"pnpm","pnpm dlx skills add cjohnhanson\u002Falmanac --skill review-deps","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Fcjohnhanson\u002Falmanac\u002Fblob\u002Fmain\u002F.agents\u002Fskills\u002Freview-deps\u002FSKILL.md",[64],{"path":65,"resourceType":66,"resourceTypeDesc":67,"sizeBytes":68,"sourceHtmlUrl":69},".almanac-origin","OTHER","其他",201,"https:\u002F\u002Fgithub.com\u002Fcjohnhanson\u002Falmanac\u002Fblob\u002Fmain\u002F.agents\u002Fskills\u002Freview-deps\u002F.almanac-origin",[71,82,87,97,102,107],{"skillNo":72,"name":73,"nameZh":6,"description":74,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":75,"categories":76,"keywords":77,"publishedAt":36},"01M71V2WRQJAQBDT023WT2N7JK","tisket-tips","Tips for writing tisket issues well.","https:\u002F\u002Fgithub.com\u002Fcjohnhanson\u002Falmanac\u002Fblob\u002Fmain\u002Ftests\u002Fmissouri\u002Fworkflow\u002Flocal-skills\u002Ftisket-tips\u002FSKILL.md",[],[78,79,28,80,81],"tisket tips","tips","issues","writing",{"skillNo":83,"name":73,"nameZh":6,"description":74,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":84,"categories":85,"keywords":86,"publishedAt":36},"01M71V2VQ3EBKD5J81GEDFVTFR","https:\u002F\u002Fgithub.com\u002Fcjohnhanson\u002Falmanac\u002Fblob\u002Fmain\u002Ftests\u002Fmissouri\u002Fupdated\u002Fskills\u002Ftisket-tips\u002FSKILL.md",[],[78,79,80,28,81],{"skillNo":88,"name":89,"nameZh":6,"description":90,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":91,"categories":92,"keywords":93,"publishedAt":36},"01M71V2TNBR56HGJ56NA0787K4","remote-tips","Remote wisdom.","https:\u002F\u002Fgithub.com\u002Fcjohnhanson\u002Falmanac\u002Fblob\u002Fmain\u002Ftests\u002Fmissouri\u002Fupdated\u002Fskills\u002Fremote-tips\u002FSKILL.md",[],[94,79,95,96],"remote tips","remote","wisdom",{"skillNo":98,"name":73,"nameZh":6,"description":74,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":99,"categories":100,"keywords":101,"publishedAt":36},"01M71V2R8K1CX8XCAPHKVWSDV7","https:\u002F\u002Fgithub.com\u002Fcjohnhanson\u002Falmanac\u002Fblob\u002Fmain\u002Ftests\u002Fmissouri\u002Fupdated\u002Flocal-skills\u002Ftisket-tips\u002FSKILL.md",[],[78,79,80,28,81],{"skillNo":103,"name":73,"nameZh":6,"description":74,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":104,"categories":105,"keywords":106,"publishedAt":36},"01M71V2Q6439KF6FDHETHNMCSY","https:\u002F\u002Fgithub.com\u002Fcjohnhanson\u002Falmanac\u002Fblob\u002Fmain\u002Ftests\u002Fmissouri\u002Fupdated-verified\u002Fskills\u002Ftisket-tips\u002FSKILL.md",[],[78,79,81,80,28],{"skillNo":108,"name":89,"nameZh":6,"description":90,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":109,"categories":110,"keywords":111,"publishedAt":36},"01M71V2P860B97PMXRJRAF1H7T","https:\u002F\u002Fgithub.com\u002Fcjohnhanson\u002Falmanac\u002Fblob\u002Fmain\u002Ftests\u002Fmissouri\u002Fupdated-verified\u002Fskills\u002Fremote-tips\u002FSKILL.md",[],[95,79,94,96]]