ca-add-dep
Vet a new or changed third-party dependency for license, provenance, and supply-chain risk before any install runs.
npx skills add arbiterForge/codeArbiter --skill ca-add-dep --agent codex
Same command for any agent — swap --agent for claude-code, cursor, copilot.
Weekly change comes from our own snapshots, not the repository page — it measures attention, not adoption.
# $ca-add-dep — dependency review Gate a new or changed third-party dependency through review before it lands. When you route through this command, the orchestrator runs no install until the `dependency-reviewer` agent clears the package. Specify the exact version if you have one; without one, the reviewer evaluates the latest available version. ## Routes to The `dependency-reviewer` agent (`${CLAUDE_PLUGIN_ROOT}/agents/dependency-reviewer.md`). The agent reads `<project-root>/.codearbiter/security-controls.md` (allowed/denied licenses, provenance and supply-chain policy) and `<project-root>/.codearbiter/tech-stack.md` (stack fit, dependency manager) to judge the package. After the agent clears it, the orchestrator surfaces the install command for confirmation. The lock file change is committed alongside the manifest change — never one without the other. ## When NOT to use - Removing a dependency → `$ca-fix` or `$ca-feature` with the change described. - Updating an existing dependency as part of a code change → `$ca-feature` / `$ca-fix`; manifest changes route to review at `$ca-pr`. - Asking about a package without installing it → `$ca-btw`. ## Ephemeral tool run — one invocation,
- Routes to
- When NOT to use
- Ephemeral tool run — one invocation, nothing adopted
- Hard gate
What does the ca-add-dep skill do?
Vet a new or changed third-party dependency for license, provenance, and supply-chain risk before any install runs.
How do I install it?
Run `npx skills add arbiterForge/codeArbiter --skill ca-add-dep --agent claude-code` — it drops the skill into your project so the agent can pick it up. Swap the --agent value for codex, cursor or copilot if you use one of those.
Where does this skill come from?
From arbiterForge/codeArbiter, a repository with 138 stars. We read it straight from the repository tree rather than a submitted listing, so what you see here is what is actually published.
Is a popular skill a good skill?
Not necessarily. Stars measure attention, not adoption — a repository can trend for a week and be abandoned. That is why we show the weekly change from our own snapshots next to the total, instead of a single flattering number.