Skip to content
Back to skills

Installing Dependencies

ASecurity

Use before installing dependencies, packages, or tools required for building project.

  • 106 stars
  • 0 votes
  • 0 copies
  • 5 views
  • Added September 12, 2026
toolspythonrustgonode

Works with

  • cli

Security analysis

A92/100
  • mediumInstalls packages at runtime which could introduce malicious dependencies
  • mediumInstalls packages at runtime which could introduce malicious dependencies

Pro shows the line behind each finding and how to fix it

Scanned September 12, 2026

npx -y skills add archibate/dotfiles-opencode --skill installing-dependencies --agent claude-code

Installs into .claude/skills of the current project.

Are you the author of Installing Dependencies?

Add the live security badge to your README. It updates with every re-scan.

Security grade badge for Installing Dependencies
[![Security: A — Skills Directory](https://www.skillsdirectory.com/api/skills/archibate-installing-dependencies/badge)](https://www.skillsdirectory.com/skills/archibate-installing-dependencies)

More formats (shields.io, HTML) on the badges page. Keep it an A: scan every change in CI with Pro.

Download with Pro
SKILL.md
---
name: installing-dependencies
description: Use before installing dependencies, packages, or tools required for building project.
---

# Installing Dependencies

## The Golden Rule

**If the install command writes anything outside the current project directory, stop and ask the user for permission first.**

This is non-negotiable. No exceptions.

## Decision Gate

Before running any install command, ask:

```
Does this command write outside the project directory?
  YES -> Ask user for permission. Do not proceed until granted.
  NO  -> Proceed.

Is there no virtual environment / local package setup yet?
  YES -> Initialize one first, then install.
  NO  -> Install into the existing local environment.
```

## Per-Ecosystem Rules

### Python

```
# Initialize venv if not present
uv venv          # preferred
python -m venv .venv

# Install into venv
uv add <pkg>
uv pip install <pkg>
.venv/bin/pip install <pkg>
```

```
# NEVER without permission
pip install <pkg>           # writes to system Python
pip install --user <pkg>    # writes to ~/.local
```

### Node.js

```
# Install locally (default behavior)
npm install <pkg>
npm install --save-dev <pkg>
bun add <pkg>
bun add -d <pkg>
```

```
# NEVER without permission
npm install -g <pkg>        # writes to system node_modules
bun add -g <pkg>
```

### Rust

```
# Add as project dependency
cargo add <pkg>
```

```
# NEVER without permission
cargo install <pkg>         # writes to ~/.cargo/bin
```

### System / OS-level tools

```
# NEVER without permission
sudo apt install <pkg>
brew install <pkg>
pip install <pkg>           # system pip
```

System-level tools (runtimes, compilers, CLI utilities) always require explicit user permission. If a required tool is missing, inform the user and ask them to install it rather than installing it yourself.

## What "Outside the Project Directory" Means

Any path that is not under the current working project folder, including:

- `~/.local`
- `~/.cargo`
- `/usr/local`
- `/usr/lib`
- Global `node_modules`
- System Python site-packages

## Asking for Permission

State clearly:
1. What you want to install
2. Where it will be written
3. Why it is needed

Wait for explicit approval before proceeding.

Attribution

Is this your skill, or is something wrong with this listing? Request removal or report an issue. Author removals are honored within 72 hours.

Comments

Loading comments…

Newsletter

Get the weekly list of safe new skills, and the ones we pulled.