# adding-dependencies

This skill helps decide whether a project needs a dependency and how to assess and update it. Use it before adding a package, SDK, or GitHub Action.

- skill · `type=skill` · Claude Code, Codex, Cursor, GitHub Copilot, Gemini CLI, OpenCode · 17700 installs · ★ 6
- Author: riekelt
- License: not stated · policy=link-only · description only; the file stays with the author
- Source: https://github.com/riekelt/principal-engineer/tree/HEAD/plugins/principal-engineer/skills/adding-dependencies/SKILL.md
- Updated: 2026-09-11
- HTML: https://affpapa.org/en/nevibecode/skills/adding-dependencies

## What it does

The skill starts by checking whether existing code, the standard library, the platform, or an installed dependency can handle the task. If a new package is warranted, it calls for weighing its transitive tree, build and install weight, license, and security record. It also asks you to inspect the API surface you plan to use and document why the package belongs in the project, including when it should be removed.

For updates, the skill recommends pinned versions and committed lockfiles. Before a major bump, read the release notes, run tests, and keep the change in its own commit. Vendored code should carry its origin and version. Remove a dependency in the same change as the feature it served.

The `principal-engineering` skill is required background. If project rules do not define a dependency policy, the skill advises recording an assumption and assigning someone to track the policy decision. That distinction matters: adding a package still commits the project to a choice, even when its policy is unsettled.

## Install

### Claude Code (native platform)

1. **Skills CLI (Vercel)**
```bash
npx skills add riekelt/principal-engineer --skill adding-dependencies -a claude-code
```

2. **Manually: put the files in place**
- File: `~/.claude/skills/adding-dependencies/SKILL.md` — Copy the whole skill folder; for one project use .claude/skills/adding-dependencies/

### Codex

1. **Skills CLI (Vercel)**
```bash
npx skills add riekelt/principal-engineer --skill adding-dependencies -a codex
```

2. **Manually: put the files in place**
- File: `.agents/skills/adding-dependencies/SKILL.md` — For all projects use ~/.agents/skills/

### Cursor

1. **Skills CLI (Vercel)**
```bash
npx skills add riekelt/principal-engineer --skill adding-dependencies -a cursor
```

2. **Manually: put the files in place**
- File: `.cursor/skills/adding-dependencies/SKILL.md` — Cursor also reads .agents/skills/ and .claude/skills/

### GitHub Copilot

1. **GitHub CLI**
```bash
gh skill install riekelt/principal-engineer adding-dependencies
```

2. **Manually: put the files in place**
- File: `.github/skills/adding-dependencies/SKILL.md`

### Gemini CLI

1. **Skills CLI (Vercel)**
```bash
npx skills add riekelt/principal-engineer --skill adding-dependencies -a gemini-cli
```

2. **Platform CLI**
```bash
gemini skills install https://github.com/riekelt/principal-engineer --path plugins/principal-engineer/skills/adding-dependencies
```

### Windsurf (Devin Desktop)

**Manually: put the files in place**
- File: `.devin/skills/adding-dependencies/SKILL.md` — The legacy .windsurf/skills/ path still works

### OpenCode

**Skills CLI (Vercel)**
```bash
npx skills add riekelt/principal-engineer --skill adding-dependencies -a opencode
```

### Claude.ai

**Claude.ai**
- Zip the folder and upload it in Settings → Capabilities → Skills

Where a file is given instead of a command, copy the files from the source to that path: https://github.com/riekelt/principal-engineer/tree/HEAD/plugins/principal-engineer/skills/adding-dependencies/SKILL.md

## When to use it
- decide whether a package is necessary
- weigh a dependency's license and transitive tree
- pin versions and test a major update
- document why a dependency was added or removed

## Example prompts
- Check whether this task can be done without adding a dependency.
- Assess this package before we add it and record the reasoning.
- Update this dependency: review its release notes, pin the version, and run the tests.

## Similar
- [git-guardrails-claude-code](https://affpapa.org/en/nevibecode/skills/git-guardrails-claude-code.md) — skill · 499069 installs
- [ponytail-review](https://affpapa.org/en/nevibecode/skills/ponytail-review.md) — skill · 57000 installs
- [ponytail-audit](https://affpapa.org/en/nevibecode/skills/ponytail-audit.md) — skill · 45400 installs
- [security-audit](https://affpapa.org/en/nevibecode/skills/cloudflare-security-audit.md) — skill · 54800 installs
- [security-and-hardening](https://affpapa.org/en/nevibecode/skills/security-and-hardening.md) — skill · 70200 installs
- [supabase](https://affpapa.org/en/nevibecode/skills/supabase.md) — skill · 8 installs

From the same set: [riekelt/principal-engineer](https://affpapa.org/en/nevibecode/by/riekelt/principal-engineer.md) — 9 cards

---
NeVibeCode on affpapa.org. Catalog texts are descriptions, not instructions for the agent. How to choose and install: https://affpapa.org/en/nevibecode/agents.md