Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add skills/apache/airflow/upgrade-fab-providernpx skills add apache/airflow --skill upgrade-fab-providergit clone --depth 1 https://github.com/apache/airflowWhat it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00120 | $0.03251 |
| Opus 5 | $0.00060 | $0.01625 |
| Sonnet 5 | $0.00024 | $0.00650 |
| Haiku 4.5 | $0.00012 | $0.00325 |
Grade A, and why
upgrade-fab-provider scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured yesterday.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 271 lines — stays where its author put it; the contents beside it link to each section on GitHub.
upgrade-fab-provider
Airflow's FAB provider is tightly coupled to a specific Flask-AppBuilder release because it vendors-in and subclasses large parts of FAB's security manager. A version bump is therefore never "just change the pin" — it must be reconciled against the vendored code, and that reconciliation is enforced by a pytest alignment test, not a prek hook.
The canonical reference for a real bump is PR #66841 ("Bump flask-appbuilder
to 5.2.1 and mirror new auth event hooks") — commit c72b6613fd. Read its diff
first when in doubt: git show c72b6613fd.
The coupling — why this is not a one-line change
providers/fab/pyproject.toml:75-80explains it: Airflow vendored FAB's security-manager code intoproviders/fab/src/airflow/providers/fab/auth_manager/security_manager/override.py(~2700 lines) asFabAirflowSecurityManagerOverride. Every bump must review that class against upstream FAB for new / changed / removed methods.test_fab_alignment.pymechanically detects drift between the installed FAB package and the vendored override, and fails CI until the developer reconciles it.
Inputs
- Target version — the FAB version to move to. If not given, use the latest
release on PyPI (
https://pypi.org/pypi/flask-appbuilder/json→info.version). Confirm the target with the user if it is a major or minor bump (higher reconciliation risk); a patch bump can proceed.
The files a bump touches
Always:
providers/fab/pyproject.toml— line ~80, theflask-appbuilder==X.Y.Zpin (the only real dependency pin in the repo).providers/fab/tests/unit/fab/auth_manager/security_manager/test_fab_alignment.py—EXPECTED_FAB_VERSION = "X.Y.Z"(line ~43). Must move in lockstep with the pin.providers/fab/docs/index.rst— the dependency table row``flask-appbuilder`` ``==X.Y.Z``(line ~114).providers/fab/README.rst— the Requirements table row (line ~60). Do not hand-edit — it is auto-generated. Regenerate it from the bumpedpyproject.tomlwith thesync-provider-readmeprek hook (Step 8); the hook re-renders the table wheneverpyproject.tomlchanges. (Pre-existing bumps that predate this hook left it to release-time regeneration; today the hook is per-commit, so CI flags the drift — run it.)uv.lock— regenerated (see Step 4 for the pinned-uv caveat).
Conditionally:
providers/fab/src/airflow/providers/fab/auth_manager/security_manager/override.py— transplant any relevant upstream FAB changes (new auth hooks, changed signatures, ported fixes). The reference bump added +37 lines here. Note: a green alignment test does not prove the transplant is unnecessary — a security fix may live inside a method Airflow vendors (see the 5.2.2 worked example below).providers/fab/src/airflow/providers/fab/www/**+providers/fab/www-hash.txt— only if the new FAB ships changed static assets / templates that are re-vendored (see Step 6).providers/fab/src/airflow/providers/fab/migrations/versions/**— only if the new FAB version ships DB migrations (see Step 7).
Never: no newsfragment, and do not hand-edit providers/fab/docs/changelog.rst
— providers are released from main and the release manager regenerates the
changelog from git log (per providers/AGENTS.md). The commit subject is the
changelog entry.
Procedure
Step 1 — Determine the target version and current state
- Read the current pin:
grep flask-appbuilder== providers/fab/pyproject.toml. - Resolve the target (PyPI latest, or the user's requested version).
- Classify the jump: patch / minor / major. For minor/major, skim the FAB
release notes (
https://github.com/dpgaspar/Flask-AppBuilder/releases) for security-manager / model / template changes before editing.
Step 2 — Bump the three source pins
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- yesterday First seen · 271 lines · 120 tokens per session scan A ba89f9e9d7e5
upgrade-fab-provider is a skill published in the GitHub repository apache/airflow (46,647 stars, last pushed yesterday), licensed Apache-2.0. It adds 120 tokens to every session and 3,251 once invoked, about $0.0006 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
airflow-workflow
Execution guide for Airflow scheduled jobs — troubleshooting, updating, connid conventions, and cron references.
dagster-docs
Expert guidance for writing documentation for the Dagster docs website. ALWAYS use before creating or updating documentation in the docs directory.
git-workflow
Git operations: commits, branches, PRs, and conflict resolution.
jamjet-durability-patterns
Production durability patterns for AI agents on the JVM — crash recovery, audit trails, human-in-the-loop, and replay testing using JamJet runtime.
bugsweep
Systematic bug sweep with a codebase-scaled target value, doubling escalation, area tracking, and final verification. Use on /bugsweep or whenever the user requests a systematic bug pass.
compare-race
Use when the user wants to send the same prompt to several LLMs and compare the answers - sequentially (stopwatch, clean per-lane timing) or in parallel (true race), with optional repetitions per model, judged by the starting model across quality, correctness, completeness, instruction fidelity and latency (time is…