# Vet

> Run a background check on a dependency before installing it. Use when the user is considering adding a package/library and wants to know if it's safe, maintained, appropriately sized, and correctly named — or wants alternatives compared.

- **Type:** Skill
- **Install:** `agentstack add skill-tokyubevoxelverse-vet-vet`
- **Verified:** Yes — security-reviewed for prompt injection and unsafe behavior
- **Seller:** [tokyubevoxelverse](https://agentstack.voostack.com/s/tokyubevoxelverse)
- **Installs:** 0
- **Category:** [Developer Tools](https://agentstack.voostack.com/c/developer-tools)
- **Latest version:** 0.1.0
- **License:** MIT
- **Upstream author:** [tokyubevoxelverse](https://github.com/tokyubevoxelverse)
- **Source:** https://github.com/tokyubevoxelverse/vet

## Install

```sh
agentstack add skill-tokyubevoxelverse-vet-vet
```

Requires the [AgentStack CLI](https://agentstack.voostack.com/docs/cli). Works with Claude Code, Cursor, and any MCP-compatible agent.

## About

# Vet

A dependency is a hire: it gets commit access to your runtime. Before it's installed, run the background check. Your output is a verdict backed by dated evidence — never vibes, never fame-by-association.

## What to check

Work through all six. Cite dates and numbers for every claim.

1. **Pulse.** Last release date, release cadence over the past two years, last commit, open-vs-closed issue flow, number of active maintainers. One maintainer who hasn't committed in 18 months is a pulse of zero regardless of stars.
2. **Weight.** Install size, bundle impact where relevant, and the full transitive dependency count. Report what the package *brings with it*, not just what it is.
3. **License.** The package's license and any conflicting licenses in its transitive tree. Flag copyleft in the tree of a commercial project loudly.
4. **Security.** Known advisories (ecosystem audit tooling, osv.dev), history of past incidents, install scripts that run arbitrary code, network calls at install time.
5. **Identity.** Typosquat check: compare the exact requested name against the popular package it resembles (character swaps, added/dropped letters, wrong scope, `-js` suffixes). Verify the registry package actually points at the repo it claims. This check has caught real attacks; take it seriously.
6. **Proportionality.** What fraction of the package would actually be used? If the answer is one function, present the inline-it-yourself option with an estimate of the code involved.

## The verdict

End with exactly one of:

- **✅ HIRE** — healthy on all six checks. One paragraph on why.
- **⚠️ HIRE WITH EYES OPEN** — usable, but with named risks and what to watch. Include a mitigation for each risk (pin the version, wrap the API, vendor it).
- **❌ PASS** — and always with 1–3 concrete alternatives, compared on the same six checks in a short table, or the inline-it-yourself sketch.

## Rules

- Evidence over reputation: a famous package can still fail Pulse or Weight *for this project's needs*.
- Judge against the project's actual context (check the manifest: existing deps may already cover this need — flag redundancy).
- If two candidates are close, say so and state the tiebreaker rather than manufacturing a winner.
- When data can't be verified (private registry, no repo link), say what couldn't be checked — an unverifiable claim is a finding, not a blank.

## Source & license

This open-source skill is cataloged on AgentStack and links to its original source — we do not rehost the code.

- **Author:** [tokyubevoxelverse](https://github.com/tokyubevoxelverse)
- **Source:** [tokyubevoxelverse/vet](https://github.com/tokyubevoxelverse/vet)
- **License:** MIT

Install and usage instructions live in the source repository linked above.

## Pricing

- **Free** — Free

## Security capabilities

Automated source analysis of v0.1.0 — what this tool can access:

- **Network access:** no
- **Filesystem access:** no
- **Shell / process execution:** no
- **Environment & secrets:** no
- **Dynamic code execution:** no

*"Yes" means the capability is present in the source — more access means more to trust, not that it is unsafe.*


## Versions

- **0.1.0** — security scan: passed — Imported from the upstream source.

## Links

- Listing page: https://agentstack.voostack.com/l/skill-tokyubevoxelverse-vet-vet
- Seller: https://agentstack.voostack.com/s/tokyubevoxelverse
- Browse the marketplace: https://agentstack.voostack.com/browse

---
Listed on AgentStack — the marketplace for AI agent skills and MCP servers. Every listing is security-reviewed. Creators keep 70%.