Borrowing it
Nothing to install: this file belongs to ajgreyling/cursor-doctor. Take a copy, put it at the same path in your own repository, and replace the rules that are about this project with yours.
curl -O https://raw.githubusercontent.com/ajgreyling/cursor-doctor/master/.cursor/skills/dependency-management/SKILL.mdgit clone --depth 1 https://github.com/ajgreyling/cursor-doctorWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/ajgreyling/cursor-doctor/dependency-management)<a href="https://agentmods.dev/skills/ajgreyling/cursor-doctor/dependency-management"><img src="https://agentmods.dev/badge/skills/ajgreyling/cursor-doctor/dependency-management.svg" alt="Measured on agentmods" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00016 | $0.00243 |
| Opus 5 | $0.00008 | $0.00121 |
| Sonnet 5 | $0.00003 | $0.00049 |
| Haiku 4.5 | $0.00002 | $0.00024 |
Grade A, and why
dependency-management scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 7d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
What it actually says
Dependency Management
Current dependency context
- Runtime deps:
fast-glob,yaml - Dev deps:
typescript,@types/node,husky - Runtime requirement: Node.js
>=18
Source of truth: package.json and package-lock.json.
When to use
- Adding a new dependency.
- Upgrading existing dependency versions.
- Investigating build or runtime issues caused by package changes.
Workflow
- Add/upgrade with npm commands (no manual lockfile editing).
- Run
npm install. - Run
npm run build. - Smoke-test commands (
generate,audit,read). - Update docs if command behavior or requirements changed.
Guardrails
- Prefer stable latest compatible versions unless the user requests pinning.
- Keep dependencies minimal; avoid adding packages for simple built-in functionality.
- If adding a dependency with security/licensing implications, document rationale in the PR/notes.
Completeness checklist
- current versions
- where to check
- how to add or upgrade
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 7d ago First seen · 41 lines · 16 tokens per session scan A 9407fe8521a5
dependency-management is a skill published in the GitHub repository ajgreyling/cursor-doctor (0 stars, last pushed 1mo ago), licensed MIT. It adds 16 tokens to every session and 243 once invoked, about $0.0001 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
go-testing
Trigger: Go tests, go test coverage, Bubbletea teatest, golden files. Apply focused Go testing patterns.
requirements-authoring
To author, update, and validate functional/non-functional requirements as atomic units with user approval.
specflow-use
To connect Rosetta with Grid Dynamics SpecFlow MCP; only when SpecFlow is mentioned and the MCP is installed.
ijfw-workflow
Use when the user says: 'build', 'create', 'plan', 'new project', 'brainstorm', 'design', 'UI', 'website', 'dashboard', 'app', 'help me build', 'launch', 'book', 'campaign', or anything project-level. Skill body decides Quick vs Deep path.
ijfw-plan
Use when the user says 'plan this', 'plan it', 'make a plan', 'let's plan', 'draft a plan', 'how should we tackle this', 'break this down', or invokes '/ijfw-plan'. Produces a falsifiable PLAN.md (software, book, campaign, design, research) with task breakdown, dependency wave-table, and success criteria — gated by…
ijfw-writing-skills
Authoring discipline for new IJFW skills. Use when creating a new skill, writing a skill, making a skill that does X, or asked to add a skill. Trigger: create a new skill, write a skill, new skill, make me a skill, skill that does, /ijfw-writing-skills.