Skip to content
Back to skills

Configure Dead Code

ASecurity

Check and configure dead code detection (Knip, Vulture, cargo-machete)

  • 58 stars
  • 0 votes
  • 0 copies
  • 2 views
  • Added February 8, 2026
developmentjavascripttypescriptpythonrustgojavabashnodegitapi

Works with

  • cli
  • api

Security analysis

A96/100
  • mediumInstalls packages at runtime which could introduce malicious dependencies

Pro shows the line behind each finding and how to fix it

Scanned February 12, 2026

npx -y skills add laurigates/claude-plugins --skill configure-dead-code --agent claude-code

Installs into .claude/skills of the current project.

Are you the author of Configure Dead Code?

Add the live security badge to your README. It updates with every re-scan.

Security grade badge for Configure Dead Code
[![Security: A — Skills Directory](https://www.skillsdirectory.com/api/skills/laurigates-configure-dead-code/badge)](https://www.skillsdirectory.com/skills/laurigates-configure-dead-code)

More formats (shields.io, HTML) on the badges page. Keep it an A: scan every change in CI with Pro.

Download with Pro
SKILL.md
---
model: haiku
created: 2025-12-16
modified: 2025-12-16
reviewed: 2025-12-16
description: Check and configure dead code detection (Knip, Vulture, cargo-machete)
allowed-tools: Glob, Grep, Read, Write, Edit, Bash, AskUserQuestion, TodoWrite, WebSearch, WebFetch
argument-hint: "[--check-only] [--fix] [--tool <knip|vulture|deadcode|machete>]"
name: configure-dead-code
---

# /configure:dead-code

Check and configure dead code detection tools.

## Context

This command validates dead code detection configuration and sets up analysis tools.

**Dead code detection tools:**
- **JavaScript/TypeScript**: Knip (finds unused files, exports, dependencies)
- **Python**: Vulture or deadcode (finds unused code)
- **Rust**: cargo-machete (finds unused dependencies)

## Version Checking

**CRITICAL**: Before configuring dead code detection tools, verify latest versions:

1. **Knip**: Check [knip.dev](https://knip.dev/) or [npm](https://www.npmjs.com/package/knip)
2. **Vulture**: Check [PyPI](https://pypi.org/project/vulture/)
3. **cargo-machete**: Check [crates.io](https://crates.io/crates/cargo-machete)

Use WebSearch or WebFetch to verify current versions before configuring dead code detection.

## Workflow

### Phase 1: Language Detection

Detect project language and existing dead code detection tools:

| Indicator | Language | Tool |
|-----------|----------|------|
| `knip.json` or `knip.config.*` | JavaScript/TypeScript | Knip |
| `package.json` with knip | JavaScript/TypeScript | Knip |
| `pyproject.toml` [tool.vulture] | Python | Vulture |
| `.vulture` or `vulture.ini` | Python | Vulture |
| `Cargo.toml` | Rust | cargo-machete |

### Phase 2: Current State Analysis

For each detected tool, check configuration:

**Knip:**
- [ ] `knip.json` or config file exists
- [ ] Entry points configured
- [ ] Ignore patterns set
- [ ] Plugin configurations
- [ ] Workspace support (monorepo)
- [ ] CI integration

**Vulture:**
- [ ] Configuration file exists
- [ ] Minimum confidence set
- [ ] Paths configured
- [ ] Ignore patterns
- [ ] Allowlist file (if needed)

**deadcode (Python):**
- [ ] `pyproject.toml` configuration
- [ ] Exclude patterns
- [ ] Dead code detection rules

**cargo-machete (Rust):**
- [ ] Installed as cargo subcommand
- [ ] Workspace configuration
- [ ] CI integration

### Phase 3: Compliance Report

Generate formatted compliance report:

```
Dead Code Detection Compliance Report
======================================
Project: [name]
Language: [TypeScript | Python | Rust]
Tool: [Knip 5.x | Vulture 2.x | cargo-machete 0.6.x]

Configuration:
  Config file             knip.json                  [✅ EXISTS | ❌ MISSING]
  Entry points            configured                 [✅ CONFIGURED | ⚠️ AUTO-DETECTED]
  Ignore patterns         node_modules, dist         [✅ CONFIGURED | ⚠️ INCOMPLETE]
  Plugin support          enabled                    [✅ ENABLED | ⏭️ N/A]

Detection Scope:
  Unused files            enabled                    [✅ ENABLED | ❌ DISABLED]
  Unused exports          enabled                    [✅ ENABLED | ❌ DISABLED]
  Unused dependencies     enabled                    [✅ ENABLED | ❌ DISABLED]
  Unused types            enabled                    [✅ ENABLED | ❌ DISABLED]
  Duplicate exports       enabled                    [✅ ENABLED | ⏭️ N/A]

Scripts:
  dead-code command       package.json scripts       [✅ CONFIGURED | ❌ MISSING]
  dead-code:fix           package.json scripts       [⏭️ N/A | ❌ MISSING]

Integration:
  Pre-commit hook         .pre-commit-config.yaml    [⚠️ OPTIONAL | ❌ MISSING]
  CI/CD check             .github/workflows/         [✅ CONFIGURED | ❌ MISSING]

Current Analysis (if available):
  Unused files            [X files]                  [✅ NONE | ⚠️ FOUND]
  Unused exports          [X exports]                [✅ NONE | ⚠️ FOUND]
  Unused dependencies     [X packages]               [✅ NONE | ⚠️ FOUND]

Overall: [X issues found]

Recommendations:
  - Remove unused dependencies to reduce bundle size
  - Clean up unused exports to improve maintainability
  - Add allowlist for intentionally unused code
```

### Phase 4: Configuration (if --fix or user confirms)

#### Knip Configuration (JavaScript/TypeScript)

**Install Knip:**
```bash
npm install --save-dev knip
# or
bun add --dev knip
```

**Create `knip.json`:**
```json
{
  "$schema": "https://unpkg.com/knip@5/schema.json",
  "entry": [
    "src/index.ts",
    "src/cli.ts",
    "src/server.ts"
  ],
  "project": [
    "src/**/*.ts",
    "src/**/*.tsx"
  ],
  "ignore": [
    "src/**/*.test.ts",
    "src/**/*.spec.ts",
    "dist/**",
    "coverage/**"
  ],
  "ignoreDependencies": [
    "@types/*"
  ],
  "ignoreExportsUsedInFile": true,
  "ignoreBinaries": [
    "tsc",
    "tsx"
  ],
  "workspaces": {
    ".": {
      "entry": "src/index.ts",
      "project": "src/**/*.ts"
    }
  }
}
```

**Alternative TypeScript config (`knip.config.ts`):**
```typescript
import type { KnipConfig } from 'knip';

const config: KnipConfig = {
  entry: [
    'src/index.ts',
    'src/cli.ts',
  ],
  project: [
    'src/**/*.ts',
    'src/**/*.tsx',
  ],
  ignore: [
    'src/**/*.test.ts',
    'dist/**',
    'coverage/**',
  ],
  ignoreDependencies: [
    '@types/*',
  ],
  ignoreExportsUsedInFile: true,
};

export default config;
```

**Add npm scripts to `package.json`:**
```json
{
  "scripts": {
    "knip": "knip",
    "knip:production": "knip --production",
    "knip:dependencies": "knip --dependencies",
    "knip:exports": "knip --exports",
    "knip:files": "knip --files"
  }
}
```

#### Vulture Configuration (Python)

**Install Vulture:**
```bash
uv add --group dev vulture
```

**Create `pyproject.toml` section:**
```toml
[tool.vulture]
min_confidence = 80
paths = ["src", "tests"]
exclude = [
    "*/migrations/*",
    "*/tests/fixtures/*",
]
ignore_decorators = ["@app.route", "@celery.task"]
ignore_names = ["setUp", "tearDown", "setUpClass", "tearDownClass"]
make_whitelist = true
```

**Alternative: Create `.vulture` config:**
```ini
[vulture]
min_confidence = 80
paths = src,tests
exclude = migrations,fixtures
```

**Create allowlist file `vulture-allowlist.py`:**
```python
"""
Vulture allowlist for intentionally unused code.

This file is referenced by Vulture to ignore known false positives.
"""

# Intentionally unused for future use
future_feature
placeholder_function

# Framework-required but appears unused
class Meta:
    pass
```

**Add scripts (manual command):**
```bash
uv run vulture src/ --min-confidence 80
```

#### deadcode Configuration (Python Alternative)

**Install deadcode:**
```bash
uv add --group dev deadcode
```

**Create `pyproject.toml` section:**
```toml
[tool.deadcode]
exclude = [
    "tests",
    "migrations",
]
ignore-names = [
    "Meta",
    "setUp",
    "tearDown",
]
```

**Run deadcode:**
```bash
uv run deadcode src/
```

#### cargo-machete Configuration (Rust)

**Install cargo-machete:**
```bash
cargo install cargo-machete --locked
```

**Run cargo-machete:**
```bash
cargo machete
```

**Optional: Create `.cargo-machete.toml`:**
```toml
[workspace]
# Exclude specific packages
exclude = ["example-package"]

# Ignore specific dependencies
ignore = ["tokio"]  # Used in proc macros
```

**For workspace:**
```toml
[workspace.metadata.cargo-machete]
ignored = ["serde"]  # Used by derive macros
```

### Phase 5: Usage Examples

#### Knip Usage

**Find all unused code:**
```bash
npm run knip
```

**Production mode (ignore devDependencies):**
```bash
npm run knip:production
```

**Find unused dependencies only:**
```bash
npm run knip:dependencies
```

**Find unused exports only:**
```bash
npm run knip:exports
```

**Fix automatically (remove unused dependencies):**
```bash
knip --fix
```

#### Vulture Usage

**Basic scan:**
```bash
uv run vulture src/ --min-confidence 80
```

**Generate allowlist:**
```bash
uv run vulture src/ --make-whitelist > vulture-allowlist.py
```

**With allowlist:**
```bash
uv run vulture src/ vulture-allowlist.py
```

**Sorted by confidence:**
```bash
uv run vulture src/ --sort-by-size
```

#### cargo-machete Usage

**Find unused dependencies:**
```bash
cargo machete
```

**Fix automatically:**
```bash
cargo machete --fix
```

**Check specific package:**
```bash
cargo machete --package my-crate
```

### Phase 6: CI/CD Integration

#### GitHub Actions - Knip

**Add to workflow:**
```yaml
- name: Install dependencies
  run: npm ci

- name: Run Knip
  run: npm run knip
  continue-on-error: true  # Don't fail CI, just warn

- name: Run Knip (production mode)
  run: npm run knip:production
```

#### GitHub Actions - Vulture

**Add to workflow:**
```yaml
- name: Install dependencies
  run: uv sync --group dev

- name: Run Vulture
  run: uv run vulture src/ --min-confidence 80
  continue-on-error: true  # Don't fail CI, just warn
```

#### GitHub Actions - cargo-machete

**Add to workflow:**
```yaml
- name: Install cargo-machete
  run: cargo install cargo-machete --locked

- name: Check for unused dependencies
  run: cargo machete
  continue-on-error: true  # Don't fail CI, just warn
```

### Phase 7: Allowlists and Ignores

**Knip ignores:**
```json
{
  "ignoreDependencies": [
    "@types/*"
  ],
  "ignoreExportsUsedInFile": true,
  "ignoreMembers": [
    "then",
    "catch"
  ]
}
```

**Vulture allowlist patterns:**
```python
# vulture-allowlist.py
"""Intentionally unused code."""

# Framework hooks
def setUp(self): pass
def tearDown(self): pass

# Future API
future_endpoint

# Exported for library users
public_api_function
```

**cargo-machete ignores:**
```toml
[workspace.metadata.cargo-machete]
ignored = [
    "serde",        # Used in derive macros
    "tokio",        # Used in proc macros
    "anyhow",       # Used via ? operator
]
```

### Phase 8: Pre-commit Integration (Optional)

**Knip (warning only):**
```yaml
repos:
  - repo: local
    hooks:
      - id: knip
        name: knip
        entry: npx knip
        language: node
        pass_filenames: false
        always_run: true
        stages: [manual]  # Only run manually, not on every commit
```

**Vulture (warning only):**
```yaml
repos:
  - repo: local
    hooks:
      - id: vulture
        name: vulture
        entry: uv run vulture src/ --min-confidence 80
        language: system
        types: [python]
        pass_filenames: false
        stages: [manual]  # Only run manually
```

### Phase 9: Standards Tracking

Update `.project-standards.yaml`:

```yaml
standards_version: "2025.1"
last_configured: "[timestamp]"
components:
  dead_code: "2025.1"
  dead_code_tool: "[knip|vulture|deadcode|machete]"
  dead_code_ci: true
```

### Phase 10: Updated Compliance Report

```
Dead Code Detection Configuration Complete
===========================================

Language: TypeScript
Tool: Knip 5.x

Configuration Applied:
  ✅ knip.json created
  ✅ Entry points configured
  ✅ Ignore patterns set
  ✅ Plugin support enabled

Scripts Added:
  ✅ npm run knip (full scan)
  ✅ npm run knip:production (production mode)
  ✅ npm run knip:dependencies (deps only)
  ✅ npm run knip:exports (exports only)

Integration:
  ✅ CI/CD check added (warning mode)

Initial Scan Results:
  📊 Unused files: 3
  📊 Unused exports: 12
  📊 Unused dependencies: 2

Next Steps:
  1. Run initial scan:
     npm run knip

  2. Review findings and clean up:
     - Remove unused files
     - Remove unused exports
     - Remove unused dependencies (npm uninstall)

  3. Add allowlist for false positives:
     Edit knip.json to ignore specific items

  4. Verify CI integration:
     Push changes and check workflow

Documentation: docs/DEAD_CODE.md
```

## Flags

| Flag | Description |
|------|-------------|
| `--check-only` | Report status without offering fixes |
| `--fix` | Apply all fixes automatically without prompting |
| `--tool <tool>` | Override tool detection (knip, vulture, deadcode, machete) |

## Examples

```bash
# Check compliance and offer fixes
/configure:dead-code

# Check only, no modifications
/configure:dead-code --check-only

# Auto-fix with Knip
/configure:dead-code --fix --tool knip
```

## Error Handling

- **No language detected**: Cannot determine appropriate tool, error
- **Tool installation fails**: Report error, suggest manual installation
- **Configuration conflicts**: Warn about multiple tools, suggest consolidation
- **High number of findings**: Suggest starting with allowlist

## See Also

- `/configure:linting` - Configure linting tools
- `/configure:all` - Run all compliance checks
- **Knip documentation**: https://knip.dev
- **Vulture documentation**: https://github.com/jendrikseipp/vulture
- **cargo-machete documentation**: https://github.com/bnjbvr/cargo-machete

Attribution

Is this your skill, or is something wrong with this listing? Request removal or report an issue. Author removals are honored within 72 hours.

Comments

Loading comments…

Newsletter

Get the weekly list of safe new skills, and the ones we pulled.