Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add skills/dork-labs/dorkos/upgrading-runtime-dependenciesnpx skills add dork-labs/dorkos --skill upgrading-runtime-dependenciesgit clone --depth 1 https://github.com/dork-labs/dorkosWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/dork-labs/dorkos/upgrading-runtime-dependencies)<a href="https://agentmods.dev/skills/dork-labs/dorkos/upgrading-runtime-dependencies"><img src="https://agentmods.dev/badge/skills/dork-labs/dorkos/upgrading-runtime-dependencies.svg" alt="Measured on agentmods" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00044 | $0.02397 |
| Opus 5 | $0.00022 | $0.01198 |
| Sonnet 5 | $0.00009 | $0.00479 |
| Haiku 4.5 | $0.00004 | $0.00240 |
Grade A, and why
upgrading-runtime-dependencies scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured yesterday.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 158 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Upgrading Runtime Dependencies
This skill teaches the judgment calls needed when upgrading dependencies that power agent runtimes. Unlike routine dependency bumps, runtime SDK upgrades require understanding what new capabilities to adopt, not just what breaks.
Core Principle
Runtime dependencies sit behind abstraction boundaries (e.g., the AgentRuntime interface). Changes to the SDK affect a confined set of files, but the implications ripple outward through the features those files enable. Your job is to trace both the direct code impact and the strategic value.
Changelog Categorization
Ambiguous Entries
Changelog entries are often vague. Use these heuristics:
| Entry Pattern | Likely Category | Why |
|---|---|---|
| "refactored X internals" | internal |
Unless X is a public API you call |
| "improved X performance" | performance |
But check if our usage pattern benefits |
| "updated X types" | Could be breaking |
Type changes can break compilation |
| "X now accepts Y" | feature |
Additive API change |
| "X no longer does Y" | breaking |
Subtractive behavior change |
| "deprecated X in favor of Y" | deprecated |
Even if X still works |
| "fixed X when Y" | fix |
Check if we hit condition Y |
Version Significance
Not all versions deserve equal attention:
- Major bumps (0.x → 1.0, 1.x → 2.0): Read every entry. These are intentional breaking points.
- Minor bumps with many changes: Skim for features and deprecations. These accumulate API surface.
- Patch bumps: Only scan for fixes that match known issues or workarounds in our code.
- Pre-1.0 minors (0.2 → 0.3): Treat like majors. SemVer allows breaking changes before 1.0.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- yesterday First seen · 158 lines · 44 tokens per session scan A 99a3a138d44b
upgrading-runtime-dependencies is a skill published in the GitHub repository dork-labs/dorkos (9 stars, last pushed today), licensed MIT. It adds 44 tokens to every session and 2,397 once invoked, about $0.0002 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-09-03.
Other skills, from other repositories
hive.chart-creation-foundations
Required reading whenever any chart tool is available. Teaches the one-tool embedding contract (call chartrender → live chart appears in chat AND a downloadable PNG lands in the queen session dir), the ECharts (data viz) vs Mermaid (structural diagrams) decision, the BI/financial-grade aesthetic baseline (no…
browser-edge-cases
SOP for debugging browser automation failures on complex websites. Use when browser tools fail on specific sites like LinkedIn, Twitter/X, SPAs, or sites with Shadow DOM.
openai-whisper-api
Transcribe audio via OpenAI Audio Transcriptions API (Whisper).
apify-skill
Run web scrapers and extract data from websites and social media platforms using Apify actors. Supports Instagram, TikTok, Twitter/X, LinkedIn, Facebook, YouTube, Google Search, and general web crawling.
browser-skill
Interactive browser automation - navigate, click, type, fill forms, take screenshots, get accessibility snapshots. Supports system Chrome/Edge via auto-detection.
github-skill
Work with GitHub via the gh CLI — clone repositories, create/list/merge pull requests, create/list issues, and run any other gh command (API calls, workflow runs, releases, repo administration). List operations return parsed JSON.