\r \r

BundlePhobia — Bundle Size & Dependency Bloat Analyzer\r

\r BundlePhobia scans your JavaScript and TypeScript projects for oversized dependencies, duplicate packages, tree-shaking failures, barrel file anti-patterns, and bundle configuration issues. It uses 90+ detection patterns covering 5 categories of bundle bloat. 100% local, zero telemetry.\r \r

Commands\r

\r

Free Tier (No license required)\r

\r

bundlephobia scan [file|dir]\r

One-shot bundle bloat scan of your project (5 file limit on free tier).\r \r How to execute:\r

bash "\x3CSKILL_DIR>/scripts/bundlephobia.sh" scan [file|dir]\r
```\r
\r
**What it does:**\r
1. Detects project type (npm/yarn/pnpm/monorepo)\r
2. Discovers JS/TS source files, package.json, and bundler configs\r
3. Scans for oversized dependencies, duplicate packages, tree-shaking failures\r
4. Checks bundle configuration (webpack, vite, rollup, esbuild)\r
5. Analyzes dependency hygiene in package.json\r
6. Calculates a 0-100 bloat score with letter grade (A-F)\r
\r
**Example usage scenarios:**\r
- "Scan my project for bundle bloat" -> runs `bundlephobia scan .`\r
- "Check if I have oversized dependencies" -> runs `bundlephobia scan .`\r
- "Find tree-shaking issues in my code" -> runs `bundlephobia scan src/`\r
- "Analyze my package.json for bloat" -> runs `bundlephobia scan package.json`\r
\r
#### `bundlephobia status`\r
Show license info and current configuration.\r
\r
```bash\r
bash "\x3CSKILL_DIR>/scripts/bundlephobia.sh" status\r
```\r
\r
#### `bundlephobia patterns`\r
List all 90+ detection patterns.\r
\r
```bash\r
bash "\x3CSKILL_DIR>/scripts/bundlephobia.sh" patterns\r
```\r
\r
### Pro Tier ($19/user/month — requires BUNDLEPHOBIA_LICENSE_KEY)\r
\r
#### `bundlephobia hooks install`\r
Install git hooks that scan for bundle bloat on every commit.\r
\r
```bash\r
bash "\x3CSKILL_DIR>/scripts/bundlephobia.sh" hooks install\r
```\r
\r
**What it does:**\r
1. Validates Pro+ license\r
2. Installs lefthook pre-commit hook targeting JS/TS files and package.json\r
3. On every commit: scans staged files for bundle bloat patterns, blocks commit if critical/high issues found\r
\r
#### `bundlephobia hooks uninstall`\r
Remove BundlePhobia git hooks.\r
\r
```bash\r
bash "\x3CSKILL_DIR>/scripts/bundlephobia.sh" hooks uninstall\r
```\r
\r
#### `bundlephobia report [dir]`\r
Generate a detailed markdown bundle health report.\r
\r
```bash\r
bash "\x3CSKILL_DIR>/scripts/bundlephobia.sh" report [dir]\r
```\r
\r
#### `bundlephobia audit [dir]`\r
Deep dependency audit — analyzes every dependency for size, alternatives, and optimization opportunities.\r
\r
```bash\r
bash "\x3CSKILL_DIR>/scripts/bundlephobia.sh" audit [dir]\r
```\r
\r
### Team Tier ($39/user/month — requires BUNDLEPHOBIA_LICENSE_KEY with team tier)\r
\r
#### `bundlephobia budget [dir]`\r
Enforce size budgets — fails if bundle exceeds configured thresholds.\r
\r
```bash\r
bash "\x3CSKILL_DIR>/scripts/bundlephobia.sh" budget [dir]\r
```\r
\r
#### `bundlephobia sarif [dir]`\r
Generate SARIF JSON output for CI/CD integration (GitHub Code Scanning, etc.).\r
\r
```bash\r
bash "\x3CSKILL_DIR>/scripts/bundlephobia.sh" sarif [dir]\r
```\r
\r
#### `bundlephobia ci [dir]`\r
CI mode — non-interactive scan with machine-readable output and exit codes.\r
\r
```bash\r
bash "\x3CSKILL_DIR>/scripts/bundlephobia.sh" ci [dir]\r
```\r
\r
## Detection Categories (90+ patterns)\r
\r
| Category | Patterns | What It Detects |\r
|----------|----------|-----------------|\r
| Oversized Dependencies | 20 | moment.js, lodash full import, faker in prod, aws-sdk v2, etc. |\r
| Duplicate & Redundant | 18 | axios + node-fetch, moment + dayjs, jest + mocha, etc. |\r
| Tree-Shaking Failures | 20 | import *, require(), barrel re-exports, namespace imports, etc. |\r
| Bundle Configuration | 18 | Missing splitChunks, no code splitting, missing externals, etc. |\r
| Dependency Hygiene | 14+ | Pinned versions, deprecated packages, devDeps in deps, etc. |\r
\r
## Configuration\r
\r
Add to `~/.openclaw/openclaw.json`:\r
\r
```json\r
{\r
  "skills": {\r
    "entries": {\r
      "bundlephobia": {\r
        "enabled": true,\r
        "apiKey": "YOUR_LICENSE_KEY",\r
        "config": {\r
          "maxBundleSize": "500KB",\r
          "ignoredPackages": [],\r
          "severityThreshold": "high",\r
          "checkTreeShaking": true,\r
          "checkDuplicates": true\r
        }\r
      }\r
    }\r
  }\r
}\r
```\r
\r
## Important Notes\r
\r
- **Free tier** works immediately — no configuration needed\r
- **All scanning happens locally** using grep-based pattern matching\r
- **License validation is offline** — no phone-home, no telemetry\r
- Works with npm, yarn, pnpm, and monorepos\r
- Supports webpack, vite, rollup, esbuild, parcel, and next.js configs\r
- POSIX-compatible — runs on macOS, Linux, and Windows (WSL/Git Bash)\r
\r
## When to Use BundlePhobia\r
\r
The user might say things like:\r
- "Scan my project for large dependencies"\r
- "Check my bundle size"\r
- "Find unnecessary packages in my project"\r
- "Are there any tree-shaking issues?"\r
- "Audit my dependencies for bloat"\r
- "Set up bundle size monitoring"\r
- "Check if I have duplicate packages"\r
- "Generate a bundle health report"\r
- "Enforce size budgets in CI"\r