Plugin

dependency-evaluator

Evaluate npm and Python packages before adding them as dependencies. Automatically gathers package metadata, analyzes source complexity, checks security and maintenance health, and produces a structured USE / EXTRACT / BUILD verdict. Auto-triggers when your agent is about to install a new package, or run on-demand with /evaluating-dependencies <package> [function]. Catches supply chain red flags like .pth injection, typosquatting, and stale maintainership.

• Published source
• Repository

Analysed

11 October 2026

Last observed

11 October 2026

What the code does

Static analysis found none of the capabilities we track, such as shell commands, network requests or file writes, in the latest version.

Having a capability is not wrongdoing; many tools need these to do their job. It tells you what to check before you install.

This is public metadata, not a safety certification or complete assessment. Static analysis cannot establish what a tool does at runtime.