Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add skills/crumbtraildev/crumbtrail-cli/dependency-bumpnpx skills add CrumbtrailDev/crumbtrail-cli --skill dependency-bumpgit clone --depth 1 https://github.com/CrumbtrailDev/crumbtrail-cliWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/crumbtraildev/crumbtrail-cli/dependency-bump)<a href="https://agentmods.dev/skills/crumbtraildev/crumbtrail-cli/dependency-bump"><img src="https://agentmods.dev/badge/skills/crumbtraildev/crumbtrail-cli/dependency-bump.svg" alt="Measured on agentmods" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00079 | $0.01523 |
| Opus 5 | $0.00039 | $0.00762 |
| Sonnet 5 | $0.00016 | $0.00305 |
| Haiku 4.5 | $0.00008 | $0.00152 |
Grade A, and why
dependency-bump scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 4d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 130 lines — stays where its author put it; the contents beside it link to each section on GitHub.
The dependency bump double edge
The defect is not in code anyone here wrote. It sits in a pinned upstream: a client library, a driver, a runtime, a rendering engine. The fix is a version bump, and the bump is the second edge, because it also brings the next breaking change with it.
Symptom
A flow that worked stops working, and nobody can name an application change that would explain it. The failure often arrives for many users at the same moment rather than spreading. The mirror image is just as common: a bump was made deliberately to fix one thing, and something unrelated that also sits on that library changed behaviour at the same time.
Do not write the cause down yet. A release regression in first party code produces exactly this symptom, and so does a vendor changing a payload out of band.
What Crumbtrail can see
A session carries the moment it was recorded, console errors and unhandled rejections including ones thrown from inside a bundled library, every request and response with status, timing and body subject to the capture size limit and the redaction policy, navigation, storage and cookie changes, backend spans where the backend integration is installed, and database row changes where the database adapter is installed.
The environment snapshot carries the browser name and version, the operating system, the
viewport, the locale, the timezone, a public client release identity read from the
<meta name="app-build"> tag when the page sets one, and whatever release, build, flag and
config values the application declared to the SDK.
It does not carry a dependency manifest, a lockfile, an installed version list, or a diff of one. Nothing in a session records which version of a library was loaded, other than the browser's own version and whatever the application chose to declare. So a bump is dated by observing when recorded behaviour changed, and it is never read directly. When you write the finding up, say that the version was inferred from timing rather than observed, because the reader will otherwise assume you saw it.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 4d ago First seen · 130 lines · 79 tokens per session scan A da0b094d309b
dependency-bump is a skill published in the GitHub repository CrumbtrailDev/crumbtrail-cli (0 stars, last pushed yesterday), licensed MIT. It adds 79 tokens to every session and 1,523 once invoked, about $0.0004 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
feishu
Work with Feishu or Lark bots, docs, sheets, bitables, approval flows, and OpenAPI/MCP setup without hardcoding credentials.
interview
Ask one useful structured question at a time only when material product/implementation choices are genuinely missing; remember answers and produce a brief/spec. Discoverable facts should be investigated instead of asked.
writing
将共享历史中的已验证事实和计算结果整理成符合受众、格式与长度约束的成稿。.
test
Detect the project’s test stack, run the narrowest useful tests, create tests when authorized, and report coverage/gaps honestly.
verify
Exercise the real app/API/CLI and collect observable evidence; tests alone do not count as end-to-end verification.
ccc
This skill should be used when code search is needed (whether explicitly requested or as part of completing a task), when indexing the codebase after changes, or when the user asks about ccc, cocoindex-code, or the codebase index. Trigger phrases include 'search the codebase', 'find code related to', 'update the…