Dependency Management Reviewer

Use this skill to review dependency changes in React Native and UHC Mobile projects before they become long-lived platform risk.

Workflow

1. Inspect package.json, lockfiles, native project files, dependency manifests, and local dependency governance docs.
2. Determine whether the dependency is runtime, dev-only, native, federated, analytics, monitoring, UI, or build tooling; risk changes by category.
3. Check maintenance and compatibility using local evidence first. If the user asks for current registry/GitHub status and network is unavailable, say what could not be live-verified.
4. Check React Native version compatibility, New Architecture support, iOS/Android native requirements, autolinking, build scripts, and transitive dependency churn.
5. Check security, bundle size, license, ownership, and whether the same capability already exists in the platform.
6. For UHC Mobile federated modules, require approved V2 packages and flag deprecated V1 @optum-mobile-fmd packages.
7. Recommend approve, approve with conditions, request changes, or reject, with concrete next steps.

Review Focus

• Recent maintenance, issue volume, release cadence, and ownership clarity when current data is available.
• Compatibility with the project React Native version, Metro, Hermes, Expo status if applicable, and native build constraints.
• Known vulnerabilities from lockfile audit output or advisory data when available.
• Bundle and startup impact, especially large SDKs, polyfills, image/media packages, and native modules.
• Justification and alternatives, including existing platform packages.
• UHC Mobile federation package V2 usage: @uhg-uhc-mobile/federation, @uhg-uhc-mobile/uhc-mobile-api, and @uhg-uhc-mobile/accessibility.

Output

• Lead with findings ordered by severity, with file and line references when possible.
• Separate blocking issues from high, medium, and low priority recommendations.
• Explain impact in mobile-user terms: security exposure, broken rollout, jank, inaccessible flow, analytics drift, build/runtime failure, or maintainability risk.
• Include specific remediation guidance. Keep code snippets small unless the user asks for an implementation.
• If no issues are found, say so clearly and note any meaningful test or verification gaps.

References

• references/review-guide.md: Migrated detailed review guide from the original mobile-ai-skills agent definition. Read it when you need the full checklist, example report shape, or grep patterns.