dependency-hygiene
From the author
Enforces pubspec/lock discipline — caret ranges in pubspec.yaml with a committed pubspec.lock as the only pin, a separately-recorded SDK version string, a version-pinned very_good_analysis include (whose missing file fails default analyze, or silently drops the ruleset where warnings are non-fatal), transitive-tree auditing before adding a package, a dependency gate that refuses network/telemetry/crash/ads/heavy-transitive deps by policy, and vendoring any bus-factor-1 native plugin behind an interface into third_party/. Use when running dart pub add/get/upgrade/outdated/deps, editing pubspec.yaml or pubspec.lock, bumping the Flutter/Dart SDK, choosing or rejecting a new dependency, removing a package, or auditing what a dependency drags in.
Install
npx skills add zakariaf/Flutter-Skills --skill dependency-hygiene -a claude-code
Installs to .claude/skills/dependency-hygiene/ · Each command fetches the skill straight from GitHub with the open skills CLI.
Byte-identical to the scanned commit, with the repository’s licence and a SOURCE.txt.
Want your agent to suggest skills while you type? See how to use skills from your IDE.
Safety checks on SKILL.md
- Ships scripts we have not reviewedLow
Why 74
aiqbench computes the trust score from public signals. It is not a security audit, so read a skill before you install it.
Similar skills
Closest to this one by what they do and when they are used.
- project-structure-and-packageszakariaf/Flutter-SkillsEnforces Flutter/Dart project scaffolding where the layout makes defects greppable — a single-package app by default (feature-first under lib/features/, shared foundation split by role in core/ data/ services/ routing/ theme/ l10n/, a thin main.dart that calls bootstrap(), no lib/src in the app), extracting a generically-named pure-Dart package only when a body of logic earns it (public barrel over private lib/src/ for PACKAGES only, meta-only deps as the compile firewall, resolution:workspace member, downward-only dependency DAG), with pubspec treated as the audit artifact and no utils/helpers/common/misc/grab-bag-shared junk-drawer folders. Use when creating any .dart file or directory, deciding where a repository/Notifier/MethodChannel/value-type/token belongs, authoring or fixing a pubspec.yaml, adding a workspace member, writing an import directive, mirroring a test under test/, or reviewing a diff for organisation.Testing★ 62
- audit-depsJoviDeCroock/prachtRun a dependency vulnerability audit and map each advisory to the pracht routes, loaders, middleware, and API handlers that import it — so you know what to retest after upgrading. Use for "audit deps", "scan for CVEs", "npm audit", "which routes use this vulnerable package".Security★ 105
- lint-and-style-configzakariaf/Flutter-SkillsEnforces a strict analysis_options.yaml built on very_good_analysis with strict-casts/strict-raw-types, a fixed set of silence-producing bug classes promoted to error (unawaited_futures, discarded_futures, empty_catches, use_build_context_synchronously, cancel_subscriptions, close_sinks, avoid_dynamic_calls, exhaustive_cases, avoid_print), dart format as the sole whitespace authority, generated-file excludes mirrored to coverage, and line-scoped-only suppression discipline; teaches the version-pinned-include trap (a missing include silently disables all rules), the errors-only-re-ranks-vs-linter-enables mechanic, and the sealed-switch analyze-vs-compile gap. Use when editing analysis_options.yaml, adding or disabling a lint, writing an `// ignore:`/`// ignore_for_file:`, bumping the Dart SDK or very_good_analysis version, wiring riverpod_lint, or explaining why discarded_futures, use_build_context_synchronously, close_sinks, or missing_provider_scope fires.Writing★ 62
- dependency-awarenessGoldziher/ai-rulezDependency vulnerability audits per language: cargo audit/deny, pip-audit, pnpm audit, govulncheck, bundler-audit, composer audit, dotnet, mix_audit. Use when adding or updating dependencies or triaging CVEs.Security★ 163
- codegen-and-toolchainzakariaf/Flutter-SkillsEnforces a deterministic build_runner codegen discipline: run one pinned `dart run build_runner build --delete-conflicting-outputs` pass BEFORE `flutter analyze` (never after), fence every builder with `generate_for:` globs in a per-package `build.yaml`, make one deliberate commit-vs-gitignore decision for `*.g.dart`/`*.freezed.dart`/`*.drift.dart` and back it with the matching CI gate (freshness diff if committed, codegen-first if gitignored), mirror the generated-file globs into the analyzer AND coverage excludes, pin the SDK, and never hand-edit generated output. Use when editing build.yaml, analysis_options.yaml, pubspec.yaml, .gitignore, .gitattributes, or CI workflows; wiring drift_dev/freezed/json_serializable/riverpod_generator/ gen-l10n/mockito codegen; fixing "missing part file", "undefined class _$Foo", or "conflicting outputs" errors; deciding whether to commit generated code; or scoping builders so one edit does not regenerate everything.Writing★ 62
- review-dependenciestobihagemann/turboDetect package managers and CI action pins, then discover outdated or vulnerable dependencies. Returns structured findings without upgrading. Use when the user asks to "review dependencies", "check for outdated packages", "check dependencies", "scan dependencies", "dependency review", "check for outdated GitHub Actions", or "are my workflow actions up to date".Engineering★ 417
Ratings & reviews
—
no reviews
Tried this skill? Rate it to help others. Sign in
Discussion
Join the discussion. Sign in