Borrowing it
Nothing to install: this file belongs to fitlab-ai/agent-infra. Take a copy, put it at the same path in your own repository, and replace the rules that are about this project with yours.
curl -O https://raw.githubusercontent.com/fitlab-ai/agent-infra/main/.agents/skills/upgrade-dependency/SKILL.mdgit clone --depth 1 https://github.com/fitlab-ai/agent-infraWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/fitlab-ai/agent-infra/upgrade-dependency)<a href="https://agentmods.dev/skills/fitlab-ai/agent-infra/upgrade-dependency"><img src="https://agentmods.dev/badge/skills/fitlab-ai/agent-infra/upgrade-dependency/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/fitlab-ai/agent-infra/upgrade-dependency"><img src="https://agentmods.dev/badge/skills/fitlab-ai/agent-infra/upgrade-dependency.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector pass
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00044 | $0.00617 |
| Opus 5.5 | $0.00018 | $0.00247 |
| Sonnet 5.5 | $0.00009 | $0.00123 |
| Haiku 4.5 | $0.00004 | $0.00062 |
Grade A, and why
upgrade-dependency scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 24d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
What it actually says
升级依赖
将依赖包升级到指定版本，并进行构建和测试验证。
本项目使用 npm、package.json 和 package-lock.json 管理依赖。
执行流程
1. 解析参数
从参数中提取：包名、原版本、新版本。
2. 查找依赖位置
在 package.json 和 package-lock.json 中确认目标包、当前版本和依赖类型。
3. 更新版本
使用 npm 更新依赖并同步 lockfile：
npm install {package}@{new-version}
4. 验证类型与核心测试
npm run typecheck
npm run test:core
npm run test:core 会先构建项目。
5. 运行完整测试（高风险升级）
主版本升级、构建工具升级或影响多个运行路径时执行：
npm test
6. 输出结果
报告：
- 修改的文件
- 构建状态（通过/失败）
- 测试状态（通过/失败）
- 发现的任何弃用警告或破坏性变更
建议下一步：
渲染下一步前先读取
.agents/rules/next-step-output.md，仅为已选场景调用统一 helper，并将 stdout 填入{next-step-commands}。
使用 agent-infra-internal agent-client next-steps --skill commit 生成本场景的 {next-step-commands}。
下一步 - 提交代码：
{next-step-commands}
注意事项
- 禁止自动提交：不要自动提交变更
- 主版本升级：警告潜在的破坏性变更
- 测试失败：先检查证据并修复任务范围内可诊断的问题，再运行相同验证；涉及范围外设计、用户数据冲突或必要授权时记录阻塞并继续独立工作
- 锁文件：如果项目使用锁文件（package-lock.json、yarn.lock 等），确保一并更新
- 传递依赖：注意升级是否影响传递依赖
错误处理
- 包未找到：提示 "Package {name} not found in dependency files"
- 构建失败：输出错误并建议检查破坏性变更
- 测试失败：先诊断并修复任务范围内可恢复的问题，再按同一验证器复测；必要时记录迁移指南相关风险
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 24d ago Changed d094cc1bfb55
- 1mo ago Changed · +2 lines c4cc2f27c338
- 1mo ago First seen · 78 lines · 44 tokens per session scan A deb03fe24954
upgrade-dependency is a skill published in the GitHub repository fitlab-ai/agent-infra (86 stars, last pushed yesterday), licensed MIT. It adds 44 tokens to every session and 617 once invoked, about $0.0002 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
plan-tree
Maintain a structured planning document tree made of roadmap/status files, implementation status or handoff TODO files, topic notes, decision records, open questions, ideas/inspiration pools, and repository/file-structure hygiene plans. Use when Codex needs to create, reorganize, audit, or update a multi-file plan…
ccb-github
Maintain this CCB project's GitHub-facing release and npm publication surface. Use when preparing, publishing, auditing, or fixing CCB releases; updating README.md, README/zh.md, localized README files, CHANGELOG.md, VERSION, package.json, GitHub release notes/assets, repository description/topics, npm registry state…
planner-task-packet
Draft CCB workflow task packets, readiness recommendations, and candidate clarification questions without mutating authoritative state.
orchestration-bundle-candidate
Select one route and return one adaptive one-to-four-workgroup bundle candidate as reply-only evidence.
planner-closure-backfill
Produce one revision-fenced Planner backfill proposal for either a Detailer replan or task-set closure, with compact Frontdesk status evidence.
ccb-diagnose
Diagnose a named CCB agent by combining authoritative runtime and job lineage with deep read-only pane inspection, apply bounded recovery when evidence supports it, verify the result, and request authorization before submitting a redacted GitHub issue. Use for $ccbdiagnose agentname, $ccb-diagnose agentname, or…