# Synchronize Dependencies from New Imports

New imports can leave dependency manifests incomplete and break builds. This skill detects missing packages, selects the package manager, and updates the relevant manifest.

## Install

```bash
npx skillstore add consiliency/dependency-sync
```

## Metadata

- Status: approved
- Slug: consiliency-dependency-sync
- Skillstore revision: r1
- Version status: missing
- Tree hash: 94ff5d2b4b4af902f77a2c6a695e7623c667501bc3e9438fb5c8d13c73aabdb4
- Author: Consiliency
- GitHub username: Consiliency
- License: MIT
- Repository: https://github.com/Consiliency/treesitter-chunker/tree/main/.ai-dev-kit/skills/dependency-sync
- Ref: 635f69fb8d2f4e6330ba47a4e5a0fb239c04d110
- Supported tools: Claude, Codex, Claude Code
- Audit status: complete
- Agent install advisory: confirmation\_required
- Manual install advisory: allowed
- Artifact signature: available
- Audit attestation: unavailable
- Human verification: not\_verified
- Risk factors: scripts, external\_commands, network, filesystem, env\_access
- Quality score: 38
- Quality tier: warning
- Public page: https://skillstore.pages.dev/skills/consiliency-dependency-sync
- Manifest: https://skillstore.pages.dev/api/skills/consiliency-dependency-sync/manifest

## Capabilities

- Detects modified Python, JavaScript, TypeScript, Go, and Rust files from git changes or task context.
- Parses common import and require patterns from modified source files.
- Excludes documented Python standard-library and Node.js built-in modules.
- Maps common import aliases and subpaths to installable package names.
- Selects uv, Poetry, pip, npm, Yarn, pnpm, Cargo, Go, or Flutter commands from project manifests.
- Classifies dependencies as production or development using file locations and package patterns.

## Use Cases

- Complete Application Manifests: Find packages introduced by recent application changes and add them to the correct production dependency section.
- Register Test Tooling: Detect test-only imports and place frameworks, linters, and type packages in development dependencies.
- Review Dependency Drift: Compare changed imports with manifests before release and produce a focused list of missing dependencies.

## Prompt Templates

### Audit Missing Dependencies

```
Review imports in modified files and list missing dependencies. Do not install packages or edit files. Explain each import-to-package mapping.
```

### Synchronize a Python Project

```
Check changed Python files against the active manifest. Ask before installing each missing package, then update the correct production or development group.
```

### Synchronize a Mixed Repository

```
Inspect changed Python and TypeScript files. Detect each project manifest, group missing packages by package manager, and request approval before every command.
```

### Run a Guarded Dependency Workflow

```
Audit modified imports, reject ambiguous mappings, verify exact registry packages, propose pinned versions, and show manifest changes. Install and commit only after explicit approval.
```

## Limitations

- Heuristic mappings can resolve uncommon or ambiguous imports to the wrong registry package.
- The skill does not assess package ownership, reputation, vulnerabilities, or malicious installation scripts.
- Package installation requires network access and can modify manifests and lockfiles.
- Default settings permit installation and repository commits without user approval.

## Best Practices

- Require explicit approval for every package name, version, registry, and installation command.
- Review manifest and lockfile diffs before running tests or creating a commit.
- Run vulnerability checks and project tests after approved dependency changes.

## Anti Patterns

- Do not install a package solely because its registry name matches an import.
- Do not select a package manager without confirming the project manifest and lockfile.
- Do not commit dependency changes before reviewing package provenance and repository diffs.

## Security Audit

- Audited at: 2026-07-13T15:58:35.028\+00:00
- Summary: Most static detections are Markdown syntax, built-in module lists, or mapping examples and are false positives. Eight findings are confirmed because the skill directs agents to run package-manager commands with inferred package names. Default automatic installation and commit settings create supply-chain and repository-integrity risks.

## Stats

- Views: 195
- Downloads: 10
- Favorites: 0
- Popularity score: 0