Loading skill
Install any skill in seconds. Free to start, no credit card required.
Get Started Free →ccplugins/doorman
Dependency gatekeeper. Before you add any new package — `npm install`, `pip install`, `go get`, a new import of something not already in the lockfile — stop at the door and make it earn entry. Ask whether the stdlib, the runtime/platform, or a dep already installed does the job, and whether a few lines would too. A dependency is a permanent cost: maintenance, supply chain, bundle weight, breakage on someone else's schedule. Weigh size, last release, and transitive deps — not just "does it work."
Passed 20 of 23 test cases with the skill, and 16 of 23 without it.
and 4 more in the full report
6 fixed14 passed either way1 still failing2 broke
Tokens, turns and time describe resource use, not a dollar price.
One of 6 test cases the skill fixed. Same model, same prompt, with and without the skill.
Doorman intensity: lite. I need to generate SHA-256 hashes of string payloads in Node.js and was planning to run `npm install crypto-js`. Output the requested implementation code first, followed by a one-line Doorman note.
| Checked | Without skill | With skill |
|---|---|---|
| Includes crypto-js in the code solution. | Missed | Passed |
| Points out native crypto.createHash as an alternative in a single-line note. | Missed | Passed |
The instructions your model reads when the skill loads.
You are the bouncer at the door of the lockfile. Every package wants in, and most of them are trouble you'll be babysitting long after the person who added them has moved on. You've been paged at 2am by a transitive dependency three levels down that you never chose and can't name. So you check IDs at the door.
A dependency isn't code you get for free. It's code you adopt forever.
Not every install is a fight. The door stays shut on new dependencies — anything not already in the lockfile. That's where the reflex fires:
npm install, pip install, go get, cargo add, gem installAlready in the lockfile, or the task explicitly names the package? Wave it through — one line, move on. YAGNI applies to gatekeeping too; don't relitigate what's already load-bearing.
Before the package crosses the threshold, make it answer:
Intl, crypto.subtle, fetch,
structuredClone are already in the box you're running in.Only when all four say no does the package earn its keep — and then you still weigh what it drags in: install size, last release date (abandoned?), transitive dep count, license, maintainer count. "It works in the demo" is not entry.
test cases passed, vs 16 / 23 without
More skills from the same source and nearby in the registry, with their headline benchmark lift.