Оптимизация зависимостей через анализ SBOM

★ 6.9 · engineering

bom-slimmer is a Claude Code skill that reviews a project's direct dependencies and designs lightweight, zero-dependency custom replacements using a CycloneDX SBOM produced by cdxgen. It parses `bom.json` to traverse the full dependency graph, quantifies transitive footprint, and leverages occurrence and callstack evidence from cdxgen's `--profile research` mode to pinpoint exactly which files and call paths use each package — no manual grep required. License metadata and publisher data are checked to flag copyleft exposure (GPL, LGPL) and high supply-chain risk from single-maintainer packages. Replacement candidates are categorized by risk: low-risk swaps include `uuid` → `crypto.randomUUID()` or `axios` → native `fetch`; complex parsers (YAML, TOML, JSON Schema) are marked high-risk. Generated snippets target compatibility with Node.js, Bun, and Deno via web-standard APIs.