Borrowing it
Nothing to install: this file belongs to fitlab-ai/agent-infra. Take a copy, put it at the same path in your own repository, and replace the rules that are about this project with yours.
curl -O https://raw.githubusercontent.com/fitlab-ai/agent-infra/main/.agents/skills/upgrade-dependency/SKILL.mdgit clone --depth 1 https://github.com/fitlab-ai/agent-infraWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/fitlab-ai/agent-infra/upgrade-dependency)<a href="https://agentmods.dev/skills/fitlab-ai/agent-infra/upgrade-dependency"><img src="https://agentmods.dev/badge/skills/fitlab-ai/agent-infra/upgrade-dependency/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/fitlab-ai/agent-infra/upgrade-dependency"><img src="https://agentmods.dev/badge/skills/fitlab-ai/agent-infra/upgrade-dependency.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector pass
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00044 | $0.00550 |
| Opus 5 | $0.00022 | $0.00275 |
| Sonnet 5 | $0.00009 | $0.00110 |
| Haiku 4.5 | $0.00004 | $0.00055 |
Grade A, and why
upgrade-dependency scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 9d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
What it actually says
升级依赖
将依赖包升级到指定版本，并进行构建和测试验证。
本项目使用 npm、package.json 和 package-lock.json 管理依赖。
执行流程
1. 解析参数
从参数中提取：包名、原版本、新版本。
2. 查找依赖位置
在 package.json 和 package-lock.json 中确认目标包、当前版本和依赖类型。
3. 更新版本
使用 npm 更新依赖并同步 lockfile：
npm install {package}@{new-version}
4. 验证类型与核心测试
npm run typecheck
npm run test:core
5. 运行完整测试（高风险升级）
主版本升级、构建工具升级或影响多个运行路径时执行：
npm test
6. 输出结果
报告：
- 修改的文件
- 构建状态（通过/失败）
- 测试状态（通过/失败）
- 发现的任何弃用警告或破坏性变更
建议下一步：
渲染下一步前先读取
.agents/rules/next-step-output.md，仅为已选场景调用统一 helper，并将 stdout 填入{next-step-commands}。
使用 agent-infra-internal agent-client next-steps --skill commit 生成本场景的 {next-step-commands}。
下一步 - 提交代码：
{next-step-commands}
注意事项
- 禁止自动提交：不要自动提交变更
- 主版本升级：警告潜在的破坏性变更
- 测试失败：报告失败详情并等待用户决定
- 锁文件：如果项目使用锁文件（package-lock.json、yarn.lock 等），确保一并更新
- 传递依赖：注意升级是否影响传递依赖
错误处理
- 包未找到：提示 "Package {name} not found in dependency files"
- 构建失败：输出错误并建议检查破坏性变更
- 测试失败：输出测试错误并建议查看迁移指南
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 9d ago First seen · 78 lines · 44 tokens per session scan A deb03fe24954
upgrade-dependency is a skill published in the GitHub repository fitlab-ai/agent-infra (83 stars, last pushed today), licensed MIT. It adds 44 tokens to every session and 550 once invoked, about $0.0002 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
rework-rate
Measure and interpret PR rework rate — the emerging 5th DORA metric.
work
Execute an approved wish plan — orchestrate subagents per task group with fix loops, validation, and review handoff.
preview-design
Render a real artifact through this branch's local MERIDIAN design code (not the published npm package) so the team can test the new Design Convention on the document / handoff / platform surfaces before it ships. Use for /preview-design, "preview the design convention", "render this with the new design", or Design…
sw-do
Implement a SpecWeave increment task by task through the ledger, with evidence per task and a verified close. Use for "implement this", "start working", "continue the increment", "keep going".
done
Close an increment: ledger check, specweave verify, optional review, then specweave complete. Use when all tasks are done and saying "close increment", "we are done", or "finish up".
xiaohongshu-image-creator
An image-making assistant for Xiaohongshu, a Chinese social platform for lifestyle, product, and educational posts. It creates vertical covers and supporting images matched to the post’s topic, audience, and visual style.