npm-deps-cleanup SKILL.md skillA
npm-deps-cleanup from asymmetric-al/core is an agent skill: a SKILL.md folder an AI agent loads when a task calls for it.
mdr add asymmetric-al/core/npm-deps-cleanup@git:20260526.876125dPins git:20260526.876125d in mdr.lock. Pin the fingerprint instead.
- Audit grade
- A, 17 of 17 checks passed
- Kind
- SKILL.md skill
- Repository
- asymmetric-al/core
- Path
.agents/skills/npm-deps-cleanup/SKILL.md- Versions recorded
- 2
- Latest version
- git:20260526.876125d, committed May 26, 2026
- First version recorded
- May 6, 2026
- Size
- 10,102 bytes
- Repository stars
- 370
- License
- AGPL-3.0
Audit and reduce JavaScript package dependency footprint across npm, pnpm, Yarn, and Bun projects. Use when asked to remove unused dependencies, deduplicate workspace dependency versions, lockfiles or node_modules, analyze direct dependencies' transitive lockfile closure, find low-risk upgrades that reduce dependency trees, inline trivial dependencies, or apply e18e dependency replacement recommendations.
Collected from public GitHub. Every version is saved exactly as it was and never changes. Install it at an exact version with the mdr tool, and every file is checked before it reaches your agent. The main file is checked against the SHA-256 fingerprint recorded here, and the others against the fingerprints GitHub keeps for its source commit. The automatic checks below grade the latest version, and the same checks always give the same file the same grade.
What the file says
# npm Dependency Cleanup Reduce JavaScript dependency footprint. Preserve the existing package manager, lockfile, workspace layout, and dependency range style unless there is a concrete reason to change them. ## Workflow 1. Establish the baseline. 2. Remove unused direct dependencies. 3. Deduplicate direct dependency versions in monorepos. 4. Rank direct dependencies by transitive lockfile closure. 5. Use closure data to find low-risk minor/patch upgrades. 6. Use closure data to find trivial dependencies worth inlining. 7. Check e18e recommendations for replacements/removals. 8. Reinstall, verify, and report measured impact. ## Package Manager Detection Use the repo's existing package manager. Prefer explicit package metadata before lockfiles: 1. `packageManager` in the root `package.json`. 2. `devEngines.packageManager.name` in the root `package.json`. 3. Lockfile inference. When `devEngines.packageManager` is present, use its `name` for npm, pnpm, Yarn, or Bun detection. Treat its `version` and `onFail` fields as policy signals, not as permission to change package managers. Infer from lockfiles only when package metadata does not identify the package manager: …
Read the whole file at its exact version.
How to install
mdr add asymmetric-al/core/npm-deps-cleanup@sha256:ec6439b43e58b9cdThe line at the top of this page pins the label git:20260526.876125d, which is what most people want. This one pins the sha256 fingerprint of the contents instead, so it survives a label being moved. Either way the exact version is written to mdr.lock, and mdr install downloads and checks those contents again, so it installs them exactly or stops with an error.
[](https://markdownregistry.com/a/art_d5tzonx3aazgqzrd)
3 badge image fetches in 30 days. What the badge shows.
Versions
The registry has recorded 2 versions of this file, between May 6, 2026 and May 26, 2026, about one every 21 days.
| version | committed | commit | size | audit | |
|---|---|---|---|---|---|
| git:20260526.876125d latest | 2026-05-26 | 876125d | 10,102 B | A | view · diff |
| git:20260506.3273688 | 2026-05-06 | 3273688 | 9,516 B | A | view |
Audit of the latest version
- pass: Frontmatter block present
- pass: Frontmatter declares a name
- pass: Frontmatter declares a description
- pass: Size between 200 bytes and 200 KB (10102 bytes)
- pass: No zero-width or bidi control characters
- pass: No instruction hidden inside an HTML comment
- pass: No link to an exfiltration or paste host
- pass: No credential-shaped string
- pass: No instruction to send local credentials anywhere
- pass: No text hidden with inline styles
- pass: No prompt-injection phrasing
- pass: No curl or wget piped into a shell
- pass: No recursive delete of root, home or parent
- pass: No instruction to read or print local credentials
- pass: No base64 blob over 200 characters
- pass: No link to a raw IP address
- pass: No script tag
Source
asymmetric-al/core · 370 stars · license AGPL-3.0 · pushed 2026-11-06 · branch develop
API
GET https://markdownregistry.com/api/v1/artifacts/art_d5tzonx3aazgqzrd GET https://markdownregistry.com/api/v1/resolve?ref=asymmetric-al/core/npm-deps-cleanup GET https://markdownregistry.com/api/v1/blob/ec6439b43e58b9cd672fbb6e6644e0d809d875b009f457a3f2b213f5e8ab3069
Your AI assistant does the legwork. You hear about the deals worth your word. Hand yours the standing instructions at modelranch.com and it joins the network that reads files like this one.
Guides: the SKILL.md format and its required fields · what to check before you install a skill · how to pin a skill to an exact version · where to find agent skills · keeping a team on the same skills · which agent file does what.