dependency-review SKILL.md skillA
dependency-review from mangowhoiscloud/geode is an agent skill: a SKILL.md folder an AI agent loads when a task calls for it.
mdr add mangowhoiscloud/geode/dependency-review@git:20260906.dc9349ePins git:20260906.dc9349e in mdr.lock. Pin the fingerprint instead.
- Audit grade
- A, 17 of 17 checks passed
- Kind
- SKILL.md skill
- Repository
- mangowhoiscloud/geode
- Path
.agents/skills/dependency-review/SKILL.md- Versions recorded
- 2
- Latest version
- git:20260906.dc9349e, committed Sep 6, 2026
- First version recorded
- Aug 25, 2026
- Size
- 2,757 bytes
- Repository stars
- 15
- License
- Apache-2.0
Review GEODE dependency direction, composition boundaries, circular imports, and optional-dependency loading when changing package or subsystem dependencies.
Collected from public GitHub. Every version is saved exactly as it was and never changes. Install it at an exact version with the mdr tool, and every file is checked before it reaches your agent. The main file is checked against the SHA-256 fingerprint recorded here, and the others against the fingerprints GitHub keeps for its source commit. The automatic checks below grade the latest version, and the same checks always give the same file the same grade.
What the file says
# Dependency & Layer Review Lens Review against [code conventions](../../../docs/architecture/naming-conventions.md) and the executable import-linter contracts in [pyproject.toml](../../../pyproject.toml). The historical six-layer/plugin map is not the current dependency contract. ## Ownership and direction ```text evolve -> evals -> core evolve --------> core ``` `core` owns the runtime; `evals` measures it; `evolve` searches over runtime evidence. Neither `core -> evals/evolve` nor `evals -> evolve` is allowed. Within `core`, follow the named process/capability contracts rather than inventing a numeric layer order. - `core.wiring` composes services through constructors and existing typed contexts. - Use a narrow, named Protocol at a real consumer/provider boundary. A concrete import inside the owning subsystem is not automatically a port violation; one implementation does not invalidate an existing isolation boundary. - ContextVars carry request identity, diagnostics, or request-local state, not service-locator DI. Do not hide a forbidden dependency behind a late import. ## Review Checklist ### 1. Trace imports against the active contracts ```bash …
Read the whole file at its exact version.
How to install
mdr add mangowhoiscloud/geode/dependency-review@sha256:dfa673b110cab871The line at the top of this page pins the label git:20260906.dc9349e, which is what most people want. This one pins the sha256 fingerprint of the contents instead, so it survives a label being moved. Either way the exact version is written to mdr.lock, and mdr install downloads and checks those contents again, so it installs them exactly or stops with an error.
[](https://markdownregistry.com/a/art_mi5cdl4c4deuqnzb)
4 badge image fetches in 30 days. What the badge shows.
Versions
The registry has recorded 2 versions of this file, between Aug 25, 2026 and Sep 6, 2026, about one every 12 days.
| version | committed | commit | size | audit | |
|---|---|---|---|---|---|
| git:20260906.dc9349e latest | 2026-09-06 | dc9349e | 2,757 B | A | view · diff |
| git:20260825.9516eab | 2026-08-25 | 9516eab | 3,413 B | A | view |
Audit of the latest version
- pass: Frontmatter block present
- pass: Frontmatter declares a name
- pass: Frontmatter declares a description
- pass: Size between 200 bytes and 200 KB (2757 bytes)
- pass: No zero-width or bidi control characters
- pass: No instruction hidden inside an HTML comment
- pass: No link to an exfiltration or paste host
- pass: No credential-shaped string
- pass: No instruction to send local credentials anywhere
- pass: No text hidden with inline styles
- pass: No prompt-injection phrasing
- pass: No curl or wget piped into a shell
- pass: No recursive delete of root, home or parent
- pass: No instruction to read or print local credentials
- pass: No base64 blob over 200 characters
- pass: No link to a raw IP address
- pass: No script tag
Source
mangowhoiscloud/geode · 15 stars · license Apache-2.0 · pushed 2026-10-19 · branch main
API
GET https://markdownregistry.com/api/v1/artifacts/art_mi5cdl4c4deuqnzb GET https://markdownregistry.com/api/v1/resolve?ref=mangowhoiscloud/geode/dependency-review GET https://markdownregistry.com/api/v1/blob/dfa673b110cab8711ad71e643cdeaa720e8194a9bedf92e516ba6d516e1ab90c
Your AI assistant does the legwork. You hear about the deals worth your word. Hand yours the standing instructions at modelranch.com and it joins the network that reads files like this one.
Guides: the SKILL.md format and its required fields · what to check before you install a skill · how to pin a skill to an exact version · where to find agent skills · keeping a team on the same skills · which agent file does what.
More from mangowhoiscloud/geode
Every file in mangowhoiscloud/geode