The Complete Production SOP: How to Deploy and Run depcheck Unused & Missing npm Dependency Detection in Autonomous AI Agents
Audit and prune unused npm dependencies with depcheck across Codex, Claude Code, and Cursor. Enforce clean builds and zero bloated packages.
Technical Overview & Architectural Context
Autonomous coding agents frequently introduce package bloat when scaffolding features or attempting iterative fixes. During rapid multi-turn development, LLMs install utility libraries, polyfills, or competing schema validators, then leave them lingering in package.json after refactoring the underlying code. Conversely, when removing obsolete modules, agents routinely delete packages still required by transitive build steps or implicitly imported via configuration presets, breaking production CI pipelines. Without strict procedural guardrails, an agent attempting to clean dependencies might blindly execute package-removal commands without accounting for subtle runtime requirements such as PostCSS plugins, ESLint configs, or TypeScript ambient declarations. The 'depcheck-unused-npm-dependencies' skill establishes a deterministic protocol: it forces the agent to execute scoped AST scans across the workspace, isolate genuinely unreferenced dependencies from configured framework plugins, review peer dependencies, and validate test and build artifacts before committing package.json modifications.
Prerequisites & Environment Requirements
Verified Search Intents & Long-Tail Queries Solved
This operational tutorial is engineered to provide deterministic solutions for these developer search queries:
Step-by-Step Execution Playbook
Local Environment Setup & SKILL.md Mounting
Create the local skill manifest directory and inject verified procedural rules.
Autonomous runtimes like Claude Code, Cursor, Codex, and Windsurf locate skill definitions within workspace configuration directories (.agents/skills, .claude/skills, or .cursor/rules). Mount the SKILL.md into the workspace skill directory so the runtime parser registers the triggers and execution policies into the active context model.
mkdir -p .agents/skills/depcheck-unused-npm-dependencies && curl -fsSL https://askills.dev/api/skills/depcheck-unused-npm-dependencies/raw -o .agents/skills/depcheck-unused-npm-dependencies/SKILL.md---
name: "depcheck-unused-npm-dependencies"
description: "Identify and purge unused dependencies, bloated devDependencies, and missing package references."
metadata:
author: "depcheck"
version: "1.0.0"
runtime_compatibility:
- "codex"
- "claude-code"
- "cursor"
- "windsurf"
triggers:
- "run depcheck"
- "find unused npm packages"
- "purge unused dependencies package.json"
permissions:
fs_read: true
fs_write: "workspace"
shell_exec: false
net_access: false
---
# depcheck Unused & Missing npm Dependency Detection
Audits Node.js projects with depcheck: scanning imports and requires across all project files, detecting declared but unused packages in package.json, finding missing dependencies, and customizing ignore lists.
## When to Invoke
Invoke this skill whenever you need to:
- run depcheck
- find unused npm packages
- purge unused dependencies package.json
## Execution SOP & Rules
1. Run audit: npx depcheck . --ignores='@types/*,eslint-*,postcss,autoprefixer'.
2. Review reported 'Unused dependencies' and 'Unused devDependencies'.
3. Remove confirmed unused packages: pnpm remove <packages> (or npm uninstall / yarn remove).
4. Verify test and build pipelines succeed cleanly after package removal.
## Verification Checklist
- Run local linting, syntax validation, and type-checks before reporting completion.
- Ensure all created or modified files adhere to workspace boundaries and avoid uncommitted secrets.
- Verify tests or build commands exit cleanly with return code 0.Place project-specific framework presets (such as Tailwind or Babel plugins) directly in the --ignores flag inside SKILL.md to avoid unnecessary re-parsing and save tokens across multi-turn sessions.
Ensure that file permissions allow read access across nested folders; otherwise depcheck cannot traverse node_modules or src directories.
Environment Configuration & Package Manager Alignment
Detect package manager lockfiles to prevent mixed-manager corruption during package pruning.
Before the agent removes any packages identified by depcheck, it must inspect the workspace root for package-lock.json, pnpm-lock.yaml, or yarn.lock. Attempting an 'npm uninstall' in a pnpm repository desynchronizes lockfiles and corrupts virtual store references.
test -f pnpm-lock.yaml && echo 'PKG_MGR=pnpm' || test -f yarn.lock && echo 'PKG_MGR=yarn' || echo 'PKG_MGR=npm'Instruct the agent in your initial workspace rules to always use the lockfile-appropriate CLI command rather than defaulting to npm.
Never run package uninstall commands with global or forced flags (-g or --force) inside an automated agent loop.
Intent Matching & Trigger Invocation
Verify deterministic activation using tested natural language prompts.
Invoke the agent using trigger phrases calibrated to match frontmatter declarations ('run depcheck', 'find unused npm packages'). The agent invokes the AST scanner with explicit baseline ignores to eliminate false positives on config-only packages.
npx --yes depcheck . --json --ignores='@types/*,eslint-*,postcss,autoprefixer,prettier,husky'Specifying '--json' produces structured output that the agent parses efficiently with minimum token consumption.
Do not omit framework-level build tooling from the ignores list; depcheck operates by AST static analysis and cannot detect dependencies invoked purely via CLI or binary hooks.
Verification, Linting & Output Quality Gate
Execute automated self-healing checks before accepting agent deliverables.
The final stage of the SOP requires the agent to execute workspace type checks and unit test suites immediately following package removal. If missing symbols or broken config loaders are detected, the agent must roll back the specific package removal before declaring completion.
npm run build && npm testInspect 'git diff package.json' to confirm that peer dependencies required by third-party packages were not inadvertently pruned.
Real-World Scenario: Audit and Purge Dead Dependencies in a Next.js Monorepo Sub-app
“Run depcheck on the web application package, find unused npm packages, remove confirmed obsolete libraries, and verify that Next.js builds cleanly.”
Runtime Troubleshooting & Failure Modes
Root Cause: Static analysis fails to locate import statements for configuration-driven tools that are only referenced in dotfiles (e.g., postcss.config.js or .eslintrc.js).
npx depcheck . --ignores='tailwindcss,postcss,autoprefixer,eslint,eslint-config-*,@types/*'Root Cause: The agent removed an indirect dependency that was dynamically required by a runtime plugin or binary script not covered by static AST scan.
git checkout package.json pnpm-lock.yaml && pnpm add <package_name> && npx depcheck . --ignores='<package_name>'Frequently Asked Questions (depcheck Unused & Missing npm Dependency Detection SOP)
Q:Can I use depcheck Unused & Missing npm Dependency Detection across Codex, Claude Code, and Cursor simultaneously?
Yes. The skill conforms to the universal SKILL.md specification supported across all modern agent runtimes. Simply mount it in each tool's recognized skills or rules directory.
Q:How does depcheck Unused & Missing npm Dependency Detection prevent context window overflow during long agent sessions?
By forcing depcheck output into machine-readable JSON flags and filtering known tooling false positives before the response enters context, the skill avoids saturating context windows with multi-megabyte terminal logs.
Q:Does this skill require escalated root or container permissions?
No. It is audited with a security score of 98/100, requires zero network access, and operates exclusively within workspace file system boundaries.
Ready to equip your autonomous agent with depcheck Unused & Missing npm Dependency Detection?
Copy the complete audited SKILL.md specification or download the 1-click zip bundle directly from our verified registry.