Prompt · Developer Tools

Dependency Vet

Evaluates a new package for security, maintenance, and supply-chain risk before you install it.

Have ready: Name the package and what you'd use it for

Fill in · 5 fields

NAME + ECOSYSTEM, e.g. lodash / npmONE SENTENCELANGUAGE, FRAMEWORK, RUNTIMESTDLIB / A SMALLER ALTERNATIVEMY PROJECT'S LICENSE

Your prompt

Should I add this dependency? Vet it for me.

Package: [NAME + ECOSYSTEM, e.g. lodash / npm]
What I need it for: [ONE SENTENCE]
My stack: [LANGUAGE, FRAMEWORK, RUNTIME]

Investigate and report:
1. Maintenance health: last release date, release cadence, open issues/PRs trend, maintainer count (bus factor).
2. Supply-chain risk: install scripts, number of transitive dependencies, known CVEs, typosquat proximity to popular packages.
3. Weight: install size and what it pulls in, and whether I could replace it with [STDLIB / A SMALLER ALTERNATIVE].
4. License compatibility with [MY PROJECT'S LICENSE].
5. Verdict: install / install with pinning and review / avoid, with the one-line reason.

If you cannot verify something from current data, mark it UNVERIFIED rather than guessing.

Paste it into Muse or any assistant. Blank fields stay as [brackets].

More like this

Shell Script Explainer