knip-cleanup — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited knip-cleanup (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Knip finds unused files, dependencies, exports, types, and duplicate packages in JavaScript/TypeScript projects. Use this skill to analyze, report, and safely clean up projects.
| Category | Description | Risk Level |
|---|---|---|
| Unused files | Source files not imported anywhere | Medium |
| Unused dependencies | Packages in dependencies/devDependencies not imported | High — safe to remove |
| Unlisted dependencies | Packages imported but not in package.json | Critical — must add |
| Unused exports | Named exports not consumed by other modules | Low — may be public API |
| Unused types | TypeScript types/interfaces not referenced | Low |
| Duplicate packages | Same package at multiple versions in lockfile | Medium |
| Unused binaries | Binaries declared but not used in scripts | Low |
| Unresolved imports | Imports that point to missing modules | Critical |
# Install as dev dependency (recommended)
pnpm add -D knip
# Or run without installing
pnpm dlx knipKnip works zero-config for many projects but supports knip.json, knip.jsonc, .knip.json, knip.ts, or a knip key in package.json.
knip.json){
"$schema": "https://unpkg.com/knip@latest/schema.json",
"entry": ["src/index.ts", "src/main.ts"],
"project": ["src/**/*.ts"],
"ignore": ["**/*.test.ts", "**/*.spec.ts"],
"ignoreDependencies": ["@types/node"]
}{
"$schema": "https://unpkg.com/knip@latest/schema.json",
"workspaces": {
"packages/*": {
"entry": ["src/index.ts"],
"project": ["src/**/*.ts"]
},
"apps/web": {
"entry": ["src/main.tsx", "next.config.{js,ts}"],
"project": ["src/**/*.{ts,tsx}"]
}
}
}Next.js:
{
"entry": [
"src/app/**/page.tsx",
"src/app/**/layout.tsx",
"src/app/**/route.ts",
"src/app/**/loading.tsx",
"src/app/**/error.tsx",
"src/app/**/not-found.tsx",
"src/middleware.ts",
"next.config.{js,ts,mjs}"
],
"project": ["src/**/*.{ts,tsx}"]
}Vite/React:
{
"entry": ["src/main.tsx", "vite.config.ts"],
"project": ["src/**/*.{ts,tsx}"]
}Express/Node API:
{
"entry": ["src/index.ts", "src/server.ts"],
"project": ["src/**/*.ts"],
"ignoreDependencies": ["@types/express"]
}Knip has built-in plugins for common tools and frameworks. These automatically detect entry points so you don't need to configure them manually:
When a plugin detects its config file, it automatically adds the right entry points. Override or extend with explicit config only when needed.
# Full scan — all issue types
pnpm knip
# Specific reporters
pnpm knip --reporter compact # Condensed output
pnpm knip --reporter json # Machine-readable JSON
pnpm knip --reporter markdown # Markdown table format
# Filter by issue type
pnpm knip --include files # Only unused files
pnpm knip --include dependencies # Only unused deps
pnpm knip --include exports # Only unused exports
pnpm knip --include types # Only unused types
pnpm knip --include duplicates # Only duplicate packages
pnpm knip --include unlisted # Only unlisted deps
# Exclude issue types
pnpm knip --exclude exports # Everything except unused exports
# Production mode (skip devDependencies analysis)
pnpm knip --production
# Strict mode (also flag re-exports and namespace imports as unused)
pnpm knip --strict
# Show which plugins are activated
pnpm knip --debug
# Performance profiling
pnpm knip --performance# Remove unused exports and dependencies automatically
pnpm knip --fix
# Preview what --fix would change (dry run)
pnpm knip --fix --dry-run
# Only fix specific categories
pnpm knip --fix --include exports
pnpm knip --fix --include dependencies
# Remove unused files (moves to trash by default if trash-cli is installed)
pnpm knip --fix --allow-remove-filesImportant `--fix` behavior:
export keywords from declarationspackage.json--allow-remove-files is passedpnpm install aftergit diff after running --fixFollow this order when cleaning up knip findings to avoid cascading false positives:
pnpm knip --include unlisted
# Add any missing packages to package.json
pnpm add <missing-package>pnpm knip --include dependencies --fix
pnpm install # Regenerate lockfile# Preview first
pnpm knip --include exports --fix --dry-run
# Then apply
pnpm knip --include exports --fix# List unused files
pnpm knip --include files
# Review each file manually before deletion
# Only use --allow-remove-files when confidentpnpm tsc --noEmit # Type check
pnpm test # Run tests
pnpm build # Verify build
pnpm knip # Re-run to confirm cleanKnip may flag things as unused that are actually needed:
{
"ignoreDependencies": ["sharp", "pg-native"]
}{
"entry": ["src/index.ts!"],
"ignore": ["src/internal/**"]
}The ! suffix means "include all exports from this entry as used."
Use the appropriate plugin or add explicit entry points.
/** @public */
export function myPublicAPI() {} // knip respects JSDoc @public tagOr use the @knip tag in comments:
// @knip — used by external consumers
export const API_VERSION = "2.0";{
"ignore": [
"**/*.d.ts",
"**/generated/**",
"scripts/**"
],
"ignoreDependencies": [
"@types/*",
"dotenv"
]
}When presenting knip results:
package.json or using pnpm dedupeKnip is included in the quality gate as a WARN-level check. For standalone deep analysis, use the /knip command instead, which provides more granular control and guided cleanup workflows.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.