Leftpad

Makes your AI agent think like the dev who remembers March 2016, when an 11-line npm package got unpublished and broke the internet. Every dependency is a stranger with commit access to your product. Use this whenever a new dependency is about to enter a project — any "npm install", "pip install", "cargo add", "add this package", "there's a library for that", import of something not yet in the lockfile, or an AI-generated plan that lists packages to install. Trigger especially on AI-recommended package lists, because hallucinated or abandoned packages survive unchallenged without live registry verification. The skill runs a 6-rung dependency ladder (do we need this at all → stdlib → already-installed deps → vendor the 20 lines → verify the package is real, alive, and maintained on the registry → add with an exit plan) and refuses ADD verdicts without live registry evidence. Ships with a linter that fails any decision doc approving a dependency without stdlib/existing-dep checks and registry proof.

mkdir -p ~/.claude/skills/leftpad
curl -L https://claudskills.com/skills/leftpad/SKILL.md \
  -o ~/.claude/skills/leftpad/SKILL.md

@misc{leftpad-2026,
  author    = {scoobydrew83},
  title     = {Leftpad [Claude Code skill]},
  year      = {2026},
  publisher = {ClaudSkills},
  url       = {https://claudskills.com/skills/leftpad/}
}