[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M70YKSA2H7Q9WSRD1ECEGY20":3,"skill-same:01M70YKSA2H7Q9WSRD1ECEGY20":64},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":18,"publishedAt":32,"linkOnly":33,"markdownContent":34,"markdownBody":35,"frontMatter":36,"refName":38,"commitSha":39,"skillDirectory":40,"forksCount":41,"repositoryHtmlUrl":42,"repositoryHomepageUrl":6,"ownerHtmlUrl":43,"ownerBlogUrl":6,"ownerDescription":6,"updatedAt":44,"install":45,"resources":57},"01M70YKSA2H7Q9WSRD1ECEGY20","build-review-dependency-hygiene",null,"Judge whether a feature diff adds unnecessary, insufficiently pinned, or license-incompatible dependencies.","jstoup111\u002Fai-conductor","jstoup111","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F1585332?v=4","01M6K374Y0VEFPVCT2KPBAN4HC","James Stoup","01M6K3751X0GFKNBD0198F50XN",7,"Apache-2.0","https:\u002F\u002Fgithub.com\u002Fjstoup111\u002Fai-conductor\u002Fblob\u002Fmain\u002Fskills\u002Fbuild-review-dependency-hygiene\u002FSKILL.md",[],[19,20,21,22,23,24,25,26,27,28,29,30,31],"review","dependency","build","hygiene","dependency hygiene","build review dependency hygiene","license","diff","dependencies","feature","judge","true","gating","2026-11-10 10:12:30",false,"---\nname: build-review-dependency-hygiene\ndisable-model-invocation: true\ndescription: \"Judge whether a feature diff adds unnecessary, insufficiently pinned, or license-incompatible dependencies.\"\nenforcement: gating\nphase: build\n---\n\n## Purpose\n\nJudge one engine-managed `build_review` dependency-hygiene rubric branch. This is a\nprovider-neutral, judgement-only policy: the engine owns scope selection, evidence assembly,\nfinding identity, and the outer gate verdict.\n\n## Judgement\n\nJudge only dependency additions or version changes introduced by the feature diff. Report one\nfinding per independent concern, anchored to the changed manifest or lockfile hunk that introduces\nit. Use on-disk evidence only for dependency and license facts.\n\n- `necessity` — when an added dependency's purpose is already served by an existing declared\n  dependency or an existing in-repo module, report a finding of at least `major` severity that names\n  the added dependency and the existing equivalent's path.\n- `pinning` — report a finding of at least `major` severity when an added or upgraded dependency\n  uses `*`, `latest`, or an unbounded `>=` range, or with a manifest change and no matching\n  committed lockfile update. Name the dependency and the manifest location.\n- `license` — compare on-disk dependency license metadata with the project's declared license. If\n  the dependency license is incompatible with the project's declared license, report a finding of\n  at least `major` severity that names both licenses and the evidence location. If no on-disk evidence\n  can determine the dependency license, report a `license` finding with severity `nit` that states\n  the license is unverifiable.\n\n## Non-findings\n\nReport no finding when an added dependency has no existing equivalent, uses a bounded specifier,\nhas a matching committed lockfile update, and has a compatible license. Report no finding for a\nlockfile-only change limited to integrity or resolution metadata, with no added, removed, or\nversion-changed dependency.\n\nReport no `pinning` finding for a library manifest's caret range on a peer or runtime dependency\nwhen that ecosystem's library convention requires no lockfile change.\n\nVulnerability, CVE, and maintenance-activity claims are outside its vocabulary and are\nnever reported.\n\n## Recommended paths\n\nConfigure manifest and lockfile paths appropriate to the project's ecosystems:\n\n- npm: `**\u002Fpackage.json`, `**\u002Fpackage-lock.json`\n- Yarn: `**\u002Fpackage.json`, `**\u002Fyarn.lock`\n- pnpm: `**\u002Fpackage.json`, `**\u002Fpnpm-lock.yaml`\n- Bundler: `**\u002FGemfile`, `**\u002FGemfile.lock`\n- pip: `**\u002Frequirements*.txt`, `**\u002Frequirements*.lock`\n- Poetry: `**\u002Fpyproject.toml`, `**\u002Fpoetry.lock`\n- uv: `**\u002Fpyproject.toml`, `**\u002Fuv.lock`\n- Go modules: `**\u002Fgo.mod`, `**\u002Fgo.sum`\n- Cargo: `**\u002FCargo.toml`, `**\u002FCargo.lock`\n- Maven: `**\u002Fpom.xml`, `**\u002F.mvn\u002Fdependency-locks\u002F**`\n- Gradle: `**\u002Fbuild.gradle*`, `**\u002Fgradle.lockfile`\n","## Purpose\n\nJudge one engine-managed `build_review` dependency-hygiene rubric branch. This is a\nprovider-neutral, judgement-only policy: the engine owns scope selection, evidence assembly,\nfinding identity, and the outer gate verdict.\n\n## Judgement\n\nJudge only dependency additions or version changes introduced by the feature diff. Report one\nfinding per independent concern, anchored to the changed manifest or lockfile hunk that introduces\nit. Use on-disk evidence only for dependency and license facts.\n\n- `necessity` — when an added dependency's purpose is already served by an existing declared\n  dependency or an existing in-repo module, report a finding of at least `major` severity that names\n  the added dependency and the existing equivalent's path.\n- `pinning` — report a finding of at least `major` severity when an added or upgraded dependency\n  uses `*`, `latest`, or an unbounded `>=` range, or with a manifest change and no matching\n  committed lockfile update. Name the dependency and the manifest location.\n- `license` — compare on-disk dependency license metadata with the project's declared license. If\n  the dependency license is incompatible with the project's declared license, report a finding of\n  at least `major` severity that names both licenses and the evidence location. If no on-disk evidence\n  can determine the dependency license, report a `license` finding with severity `nit` that states\n  the license is unverifiable.\n\n## Non-findings\n\nReport no finding when an added dependency has no existing equivalent, uses a bounded specifier,\nhas a matching committed lockfile update, and has a compatible license. Report no finding for a\nlockfile-only change limited to integrity or resolution metadata, with no added, removed, or\nversion-changed dependency.\n\nReport no `pinning` finding for a library manifest's caret range on a peer or runtime dependency\nwhen that ecosystem's library convention requires no lockfile change.\n\nVulnerability, CVE, and maintenance-activity claims are outside its vocabulary and are\nnever reported.\n\n## Recommended paths\n\nConfigure manifest and lockfile paths appropriate to the project's ecosystems:\n\n- npm: `**\u002Fpackage.json`, `**\u002Fpackage-lock.json`\n- Yarn: `**\u002Fpackage.json`, `**\u002Fyarn.lock`\n- pnpm: `**\u002Fpackage.json`, `**\u002Fpnpm-lock.yaml`\n- Bundler: `**\u002FGemfile`, `**\u002FGemfile.lock`\n- pip: `**\u002Frequirements*.txt`, `**\u002Frequirements*.lock`\n- Poetry: `**\u002Fpyproject.toml`, `**\u002Fpoetry.lock`\n- uv: `**\u002Fpyproject.toml`, `**\u002Fuv.lock`\n- Go modules: `**\u002Fgo.mod`, `**\u002Fgo.sum`\n- Cargo: `**\u002FCargo.toml`, `**\u002FCargo.lock`\n- Maven: `**\u002Fpom.xml`, `**\u002F.mvn\u002Fdependency-locks\u002F**`\n- Gradle: `**\u002Fbuild.gradle*`, `**\u002Fgradle.lockfile`\n",{"name":5,"phase":21,"description":7,"enforcement":31,"disable-model-invocation":37},true,"main","34b11234d8660783bd73a6d88385cf96cd86d0d7","skills\u002Fbuild-review-dependency-hygiene",2,"https:\u002F\u002Fgithub.com\u002Fjstoup111\u002Fai-conductor","https:\u002F\u002Fgithub.com\u002Fjstoup111","2026-11-11 22:26:29",{"source":8,"skillName":5,"commands":46,"prompt":56,"zipAvailable":37},[47,50,53],{"tool":48,"command":49},"npx","npx skills add jstoup111\u002Fai-conductor --skill build-review-dependency-hygiene",{"tool":51,"command":52},"bunx","bunx skills add jstoup111\u002Fai-conductor --skill build-review-dependency-hygiene",{"tool":54,"command":55},"pnpm","pnpm dlx skills add jstoup111\u002Fai-conductor --skill build-review-dependency-hygiene","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Fjstoup111\u002Fai-conductor\u002Fblob\u002Fmain\u002Fskills\u002Fbuild-review-dependency-hygiene\u002FSKILL.md",[58],{"path":59,"resourceType":60,"resourceTypeDesc":61,"sizeBytes":62,"sourceHtmlUrl":63},"agents\u002Fopenai.yaml","REFERENCE","参考文档",43,"https:\u002F\u002Fgithub.com\u002Fjstoup111\u002Fai-conductor\u002Fblob\u002Fmain\u002Fskills\u002Fbuild-review-dependency-hygiene\u002Fagents\u002Fopenai.yaml",[65,104,131,150,167,188],{"skillNo":66,"name":67,"nameZh":6,"description":68,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":69,"categories":70,"keywords":84,"publishedAt":32},"01M6K3EQQ6ADH3G2RMYK6XE26E","writing-system-tests","Use BEFORE implementing any feature that has stories in .docs\u002Fstories\u002F — generates failing acceptance specs from acceptance criteria as the RED phase of TDD. Generates HTTP\u002Frequest-level acceptance tests for headless\u002FAPI projects, end-to-end UI tests for projects with a frontend, using the project's own test framework and directory conventions.","https:\u002F\u002Fgithub.com\u002Fjstoup111\u002Fai-conductor\u002Fblob\u002Fmain\u002Fskills\u002Fwriting-system-tests\u002FSKILL.md",[71,76,79],{"categoryNo":72,"categoryName":73,"taxonomyType":74,"taxonomyTypeDesc":75},"01JBSEEDCAT000000000000009","前端开发","SCENARIO","使用场景",{"categoryNo":77,"categoryName":78,"taxonomyType":74,"taxonomyTypeDesc":75},"01JBSEEDCAT000000000000018","写作与文案",{"categoryNo":80,"categoryName":81,"taxonomyType":82,"taxonomyTypeDesc":83},"01JBSEEDCAT000000000000036","内容创作者","PROFESSION","适用职业",[85,86,87,88,89,90,91,92,93,94,95,96,97,98,99,100,101,31,102,103],"writing","system","tests","writing system tests","projects","headless","project","end","implementing","frontend","acceptance","api","claims","directory","ui","framework","failing","phase","request",{"skillNo":105,"name":106,"nameZh":6,"description":107,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":108,"categories":109,"keywords":110,"publishedAt":32},"01M6K3EHR0QQ1QY1S9RC6D1WTD","verify-claims","Use only when an active workflow is about to rely on a nontrivial factual claim or assumption for a spec, plan, ADR, finding, or code decision. Do not invoke for casual questions, status reports, restatements, or trivially verifiable mechanics.","https:\u002F\u002Fgithub.com\u002Fjstoup111\u002Fai-conductor\u002Fblob\u002Fmain\u002Fskills\u002Fverify-claims\u002FSKILL.md",[],[111,97,112,113,114,115,116,117,30,118,119,120,121,122,123,124,125,126,127,128,129,31,130],"verify claims","verify","do","adr","for","decision","claim","mechanics","only","use","workflow","code","reports","plan","active","questions","about","spec","invoke","when",{"skillNo":132,"name":133,"nameZh":6,"description":134,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":135,"categories":136,"keywords":137,"publishedAt":32},"01M6K3ED4NF5DJA2Y35MH2JCRC","tdd","Use when implementing any feature or bugfix. Five-step cycle: RED → DOMAIN → GREEN → DOMAIN → COMMIT. Enforces test-first development with domain integrity review at every phase boundary.","https:\u002F\u002Fgithub.com\u002Fjstoup111\u002Fai-conductor\u002Fblob\u002Fmain\u002Fskills\u002Ftdd\u002FSKILL.md",[],[133,138,139,140,93,141,19,142,143,144,145,28,146,30,120,147,148,149,130,102],"green","cycle","structural","commit","at","bugfix","integrity","domain","development","with","test","test-first",{"skillNo":151,"name":152,"nameZh":6,"description":153,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":154,"categories":155,"keywords":156,"publishedAt":32},"01M6K3E6PEXBXYY2K8TSRTN1JT","stories","Use only within active engineer\u002Fconduct DECIDE after architecture approval, when a committed `.docs\u002Fstories` acceptance artifact is required. Do not invoke for general user-story examples, requirements discussion, or direct implementation requests.","https:\u002F\u002Fgithub.com\u002Fjstoup111\u002Fai-conductor\u002Fblob\u002Fmain\u002Fskills\u002Fstories\u002FSKILL.md",[],[152,157,113,115,158,159,160,30,119,120,95,161,162,163,97,164,112,165,125,166,129,31,130],"conduct","decide","engineer","general","requirements","architecture","examples","artifact","requests","implementation",{"skillNo":168,"name":169,"nameZh":6,"description":170,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":171,"categories":172,"keywords":173,"publishedAt":32},"01M6K3E1HE7267YKFJQ3YFCGW5","stack-land","Use when an operator needs to land reviewed manual changes on the correct closed child of a stacked feature. Operator-invoked only: inspect ownership, propose the safe child with evidence, and require confirmation before opening the landing.","https:\u002F\u002Fgithub.com\u002Fjstoup111\u002Fai-conductor\u002Fblob\u002Fmain\u002Fskills\u002Fstack-land\u002FSKILL.md",[],[174,175,176,147,97,177,178,179,112,28,180,181,182,183,184,30,185,119,120,186,130,187],"stack","land","stack land","evidence","child","changes","inspect","manual","correct","landing","safe","operator","confirmation","advisory",{"skillNo":189,"name":190,"nameZh":6,"description":191,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":192,"categories":193,"keywords":197,"publishedAt":32},"01M6K3DX3DTQ5MY3XDKDQ8K4JE","simplify","Use only at an active pipeline batch boundary after code has changed. Reviews current-batch duplication, complexity, over-engineering, and domain-modelling defects; do not invoke for ordinary refactors, code review, or requests that merely ask for simpler prose or code.","https:\u002F\u002Fgithub.com\u002Fjstoup111\u002Fai-conductor\u002Fblob\u002Fmain\u002Fskills\u002Fsimplify\u002FSKILL.md",[194],{"categoryNo":195,"categoryName":196,"taxonomyType":74,"taxonomyTypeDesc":75},"01JBSEEDCAT000000000000007","代码审查",[190,198,113,199,145,115,200,201,202,119,120,203,204,122,205,19,206,165,129,31],"complexity","reviews","pipeline","defects","code review","false","ask","batch","boundary"]