That's it. It doesn't figure out if dependencies are met, it doesn't mutate package.json data objects (beyond what read-package-json already does), it doesn't limit its search to include/exclude ...