adding-dependencies skill (riekelt): exhaust what you have, then vet what you add

Makes Claude exhaust what the repo already has before adding a package, then vet it, pin it and record why.

Installs: 20.2K; on skills.sh
Stars: 7; on GitHub
Updated: Sep 2026; last repo commit

adding-dependencies applies when Claude is about to add, update, vet or remove a package, library, SDK, GitHub action, base image or vendored code. It works down seven steps: the need itself, this codebase, the standard library, the platform, a dependency the project already carries, a few lines of your own, and only then a new dependency. A new one is costed (transitive tree, licence, security history, release pulse), pinned with a committed lockfile and recorded as a decision. It names principal-engineering as required background.

Good for

Developers whose Claude installs a package for a ten-line job
Maintainers who want pinned versions and lockfiles kept in order
Teams that declare a dependency posture, such as an allowlist

Install adding-dependencies

Claude Code

Copy this prompt.

Install the adding-dependencies skill in Claude Code. Run this command:

/plugin marketplace add riekelt/principal-engineer
/plugin install principal-engineer@principal-engineer

Then check that it loaded and tell me how to use it.

2
Paste it into Claude Code. It shows the change and asks before running it.

Pick one route. The plugin installs all 11 skills in the repo, plus one agent (change-verifier) and two commands (/verify and /preflight), counted from the git tree. adding-dependencies names principal-engineering as required background, so the skills CLI and folder routes below install both. There is no Claude app upload route: the README documents only the Claude Code plugin and the other-agents routes.

From the project README. Source.

What's in the skill

When it loads

Use when about to add, update, vet, or remove a dependency - a package, library, SDK, GitHub action, base image, or vendored code - or when a project's dependency posture needs declaring. Encodes the exhaust-what-you-have ladder, the vetting questions, and pin-and-prove updating. Use even for a tiny utility package: that is exactly how the tree grows.

Sections in SKILL.md

Overview
Exhaust what you already have
Vetting the one you take
Dependency posture
Pin and prove
Removal
Common mistakes

Key facts

Author: riekelt (named as author in the plugin manifest)
License: MIT per the README and plugin.json; the repo has no LICENSE file and GitHub shows none
Installs on skills.sh: 20,209 (Nov 2, 2026)
GitHub stars: 7 for the whole riekelt/principal-engineer repo (Nov 2, 2026)
Last repo commit: Sep 11, 2026
Audits on skills.sh: Gen Agent Trust Hub: pass, Socket: pass, Snyk: warn
What it includes: 1 file: SKILL.md (counted from the git tree)
Part of: The principal-engineer plugin: 11 skills, 1 agent and 2 commands (counted from the git tree)
Needs: The principal-engineering skill, named as required background in SKILL.md
Works in: Claude Code via the plugin; other agents via a plugin loader or symlinked skill folders, as the README describes

What it includes

Seven steps, from "skip the need" down to a vetted new dependency
The need, this codebase, the standard library, the platform, an existing dependency, a few lines of your own, then a new one.
Read · Exhaust what you already have
Costs the tree, licence and security history; checks the project's pulse
Five checks, including reading the part of the API you will call and preferring the tool with one job.
Read · Vet the one you take
Honors the posture the project declares, or asks for it
Fully self-contained, a curated allowlist, or vet-and-add. If nobody can answer, Claude proceeds under a stated assumed posture and tracks the question.
Read · Dependency posture
Commits lockfiles, pins versions, reads release notes before a major bump
A major bump gets its own commit and the tests run against it. Vendored code carries its origin and version.
Runs code · Pin and prove
A dependency whose job disappeared leaves in the same change
When it is down to one small call site, consider owning those lines instead.
Write · Removal

From the official docs

Permissions

Low risk

adding-dependencies is instructions for Claude and the plugin route adds an agent and two commands. Our advice: review the diff after each session and keep your tool's permission prompts on.

What it can do

Read your data
Create and change things
Delete things
Read-only mode

Watch out for

Claude can add or update packages in your project
When the seven steps end in a new dependency, Claude adds third-party code to your project. SKILL.md asks for vetting and pinned versions. Our advice: review the lockfile diff before you merge. github.com
The plugin route adds an agent that can run shell commands
change-verifier lists the tools Read, Glob, Grep and Bash, and the plugin adds the /verify and /preflight commands. The repo tree has no hooks or MCP config files. Use the skills CLI route to install only this skill. github.com

Technical details

Turning on read-only	SKILL.md describes no read-only mode.
Sign-in and keys	SKILL.md names no account, key or token.
Scopes	Claude changes dependency versions, manifests and lockfiles when it adds, updates or removes a package The plugin route also installs 10 other skills, one agent and two commands

Questions

What does adding-dependencies do?

It stops Claude from reaching for a package first. It works down a list that starts with the codebase, the standard library and the platform, and only then vets, pins and records a new dependency.

How do I install it?

Use the install box at the top. The skills CLI and folder routes add principal-engineering as well, because this skill names it as required background. The plugin route installs all eleven skills.

Does it ban new dependencies?

No. The last step of the list is a new dependency, vetted for cost, pulse and licence. SKILL.md also says to honor a posture the project declares, such as a ban on external code or a curated allowlist.

Does it handle updates and removals?

Yes. It says to read release notes before a major bump, run the tests against it, give a major bump its own commit, and remove a dependency in the same change that removed its job.

Does it work in the Claude app or Codex?

The README documents the Claude Code plugin and, for other agents, a plugin loader pointed at plugins/principal-engineer/ or symlinked skill folders. It documents no Claude app upload route.

Is it safe to install?

The skill folder bundles no scripts. It governs when Claude adds or updates packages in your project, so check lockfile changes. The plugin route also adds an agent, covered under "Watch out for".

Information

updated Nov 2, 2026

Repository: riekelt/principal-engineer
Folder: plugins/principal-engineer/skills/adding-dependencies

riekelt/principal-engineer skills.sh

Sources

Docs, issue trackers and discussions this page is built from.

Show all 5

adding-dependencies SKILL.md · github.com
principal-engineering SKILL.md · github.com
README · github.com
plugin.json · github.com
change-verifier agent · github.com