accessibility-gate
Use as a pass/fail gate on any diff with a user-facing surface — by code-reviewer during review, by qa-engineer during the test…
@vmobifystudioInstall SkillDevelopment
Skill
/dependency-policy
Audit declared dependencies, lockfiles, tool versions, compatibility, licenses, and upgrade evidence before implementation or release.
Claude Code
$ npx -y skills add vmobifystudio/app-dev-team --skill dependency-policy --agent claude-code
Codex
$ npx skills add vmobifystudio/app-dev-team --skill dependency-policy -a codex -y
Cursor
$ npx skills add vmobifystudio/app-dev-team --skill dependency-policy -a cursor -y
Gemini CLI
$ npx skills add vmobifystudio/app-dev-team --skill dependency-policy -a gemini-cli -y
GitHub Copilot
$ npx skills add vmobifystudio/app-dev-team --skill dependency-policy -a github-copilot -y
OpenCode
$ npx skills add vmobifystudio/app-dev-team --skill dependency-policy -a opencode -y
Windsurf
$ npx skills add vmobifystudio/app-dev-team --skill dependency-policy -a windsurf -y
SKILL.md
dependency-policy.SKILL.mdname: dependency-policy
description: Audit declared dependencies, lockfiles, tool versions, compatibility, licenses, and upgrade evidence before implementation or release.
Dependency policy
Use when a project adds, removes, upgrades, or relies on a package, SDK, compiler, runtime, service, model, or third-party API. Also use during onboarding, architecture review, and release preparation.
Procedure
1. Run `node "${CLAUDE_PLUGIN_ROOT}/scripts/dependency-check.mjs" <project-root>`. 2. Read the architecture and stack-defaults documents before choosing a version. 3. Confirm the declaration and lockfile changed together where the ecosystem uses a lockfile. 4. Record direct dependency, purpose, version constraint, transitive risk, license, minimum platform, deprecation status, and rollback/removal plan in the ticket evidence. 5. Use the project-pinned toolchain (`gradlew`, `Package.resolved`, lockfile, or equivalent). Never silently install a global version to make a check pass. 6. If a dependency is unapproved, unpinned, unlocked, incompatible, or unknown, block or escalate; do not “resolve” it by picking the newest version from memory.
Policy
- Prefer platform-native libraries and the smallest dependency surface.
- A new dependency needs a written reason and an owner.
- A version claim must name its source and date; “latest” is not evidence.
- A failed or unavailable vulnerability/license lookup is `CANNOT EVALUATE`, not a clean result.
- Never update a lockfile without reviewing the resulting transitive diff.
Read more
name: dependency-policy description: Audit declared dependencies, lockfiles, tool versions, compatibility, licenses, and upgrade evidence before implementation or release.
Dependency policy
Use when a project adds, removes, upgrades, or relies on a package, SDK, compiler, runtime, service, model, or third-party API. Also use during onboarding, architecture review, and release preparation.
Procedure
1. Run `node "${CLAUDE_PLUGIN_ROOT}/scripts/dependency-check.mjs" <project-root>`. 2. Read the architecture and stack-defaults documents before choosing a version. 3. Confirm the declaration and lockfile changed together where the ecosystem uses a lockfile. 4. Record direct dependency, purpose, version constraint, transitive risk, license, minimum platform, deprecation status, and rollback/removal plan in the ticket evidence. 5. Use the project-pinned toolchain (`gradlew`, `Package.resolved`, lockfile, or equivalent). Never silently install a global version to make a check pass. 6. If a dependency is unapproved, unpinned, unlocked, incompatible, or unknown, block or escalate; do not “resolve” it by picking the newest version from memory.
Policy
- Prefer platform-native libraries and the smallest dependency surface.
- A new dependency needs a written reason and an owner.
- A version claim must name its source and date; “latest” is not evidence.
- A failed or unavailable vulnerability/license lookup is `CANNOT EVALUATE`, not a clean result.
- Never update a lockfile without reviewing the resulting transitive diff.
Ships withapp-dev-team
Describe your app idea in one line. Get a shipped iOS & Android app. AI App Studio is a team of 30 AI specialists — a CEO, product manager, designers, iOS/Android engineers, a code reviewer, QA, and a release manager — that works like a real software studio.
532 skills30 agents
Stars on GitHub
Momentum
- stars in total
- 5
Other skills on app-dev-team.
@vmobifystudioInstall Skillagent-isolation
Use before spawning any agent that writes files, and by every developer/fixer agent as its first and last action. Gives each…
@vmobifystudioInstall Skillarchitecture-builder
Use to produce the technical architecture doc and engineering principles for a mobile app. Used primarily by the CTO agent.…
@vmobifystudioInstall Skillboard-doctor
Use to validate docs/31-board.md before spawning any agent, and to verify a developer's "DONE" claim before moving a row to…
@vmobifystudioInstall Skillbrownfield-onboarding
Use when pointing the team at an EXISTING, already-built app instead of a blank project — detects the stack, reverse-engineers…
@vmobifystudioInstall Skillbusiness-model
Use when deciding or revisiting how the product makes money — pricing, tiers, trial shape, ad load, unit economics — by ceo when…
@vmobifystudioInstall SkillMore skills from other plugins.
Auto-invoked
brainstorming
You MUST use this before any creative work - creating features, building components, adding functionality, modifying behavior, or…
@obraInstall Skillask-matt
Ask which skill or flow fits your situation. A router over the skills in this repo.
@mattpocockInstall SkillAuto-invoked
Questions about dependency-policy.
- Which coding agents can use dependency-policy?
- dependency-policy installs in Claude Code, Codex, Cursor, Gemini CLI, GitHub Copilot, OpenCode and Windsurf with the skills CLI, using each agent's flag shown on this page. Flowy's auto-invocation, which fires a skill when your prompt matches, runs in Claude Code only.