What is dependency-version-check?

A check for dependency versions pinned in a Dockerfile, which is the recipe used to build a container. It compares those versions with the latest versions available from their upstream sources.

Use it after editing dependency version arguments or when a container build has a version-related failure.

It detects outdated or incorrectly pinned tools before a push or merge, while keeping the Dockerfile as the single place where versions are changed.

How gitricko/hermes-webtop configures Claude Code and Codex

Reuse

Borrowing it

Nothing to install: this file belongs to gitricko/hermes-webtop. Take a copy, put it at the same path in your own repository, and replace the rules that are about this project with yours.

Copy the file

curl -O https://raw.githubusercontent.com/gitricko/hermes-webtop/main/.agents/skills/dependency-version-check/SKILL.md

Clone the repo

git clone --depth 1 https://github.com/gitricko/hermes-webtop

Made for: Claude Code, Codex.

Wrote this? Show the measurements

A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.

README.md

[![agentmods](https://agentmods.dev/badge/skills/gitricko/hermes-webtop/dependency-version-check/github.svg)](https://agentmods.dev/skills/gitricko/hermes-webtop/dependency-version-check)

Your own site

<a href="https://agentmods.dev/skills/gitricko/hermes-webtop/dependency-version-check"><img src="https://agentmods.dev/badge/skills/gitricko/hermes-webtop/dependency-version-check/github.svg" alt="Measured on agentmods" height="20"></a>

Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.

Your own site · 80×15

<a href="https://agentmods.dev/skills/gitricko/hermes-webtop/dependency-version-check"><img src="https://agentmods.dev/badge/skills/gitricko/hermes-webtop/dependency-version-check.svg" alt="Reviewed on agentmods" width="80" height="20"></a>

Per session 22 Skills are progressive disclosure: only the name and description are preloaded; the body loads when the skill is used.

When invoked 925 The whole file, excluding the scripts and references it only reads on demand.

Security scan A 0 findings. A grade says what 26 rules found in the file — not that it is safe.

Origin original No closer match found in the catalogue.

Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

Model	Per session	Once invoked
Fable 5.1	$0.00022	$0.00925
Opus 5.5	$0.00009	$0.00370
Sonnet 5.5	$0.00004	$0.00185
Haiku 4.5	$0.00002	$0.00093

Measured 1mo ago against content hash 53565b11a3e5, method: parsed. Prices are Anthropic first-party input rates as of 2026-10-07, from the pricing page.

Security

Grade A, and why

dependency-version-check scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 1mo ago.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Nothing flagged

None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.

.agents/skills/dependency-version-check/SKILL.md · 99 lines

How it starts

The opening of the file, as written. The whole thing — 99 lines — stays where its author put it; the contents beside it link to each section on GitHub.

Dependency Version Check Skill

Runs scripts/check-deps.sh — compares every dependency version pinned in docker/Dockerfile (the single source of truth) against its upstream registry.

No hardcoded versions in the script — it reads Dockerfile ARGs at runtime, so the Dockerfile is always the authoritative place to bump versions.

When to Use

Before every push / PR merge that touches docker/Dockerfile
When CI build fails on a version-specific error
Periodically to check for upstream releases
After editing any ARG *_VERSION line

How to Run

bash scripts/check-deps.sh

Expected output format:

=== Hermes Webtop Dependency Check ===
(current versions read from docker/Dockerfile ARGs)

NPM packages:
  9router            current=0.5.91 | latest=0.5.91 [OK]
  omniroute          current=3.8.51 | latest=3.8.51 [OK]
  pi-coding-agent    current=0.87.1 | latest=0.87.1 [OK]

GitHub-release binaries:
  hermes-agent       current=2026.9.24 | latest=2026.9.24 [OK]
  node               current=26.10.0 | latest=26.10.0 [OK]
  ollama             current=0.35.0 | latest=0.35.0 [OK]
  code-server        current=4.139.1 | latest=4.139.1 [OK]
  mnemon             current=0.2.9 | latest=0.2.9 [OK]
  herdr              current=0.7.4 | latest=UNAVAILABLE

Status markers:

[OK] — current == latest
[UPDATE AVAILABLE] — a newer stable release exists → bump the Dockerfile ARG
UNAVAILABLE — upstream source query failed (no tags, rate limit, or different repo layout)

What It Checks

Check	Source	Function
9router, omniroute, pi-coding-agent	npm registry	`npm_latest`
hermes-agent, ollama, code-server, mnemon, herdr	GitHub tags API	`gh_latest`
node	nodejs.org dist index (same major line)	`node_latest`

Pre-release Filtering

gh_latest filters out pre-release tags: rc, beta, alpha, preview, pre-, dev, nightly, canary, next (case-insensitive, anywhere in tag name). Leading v is stripped. This prevents false "update available" on tags like v0.40.0-rc0.

Read the full file on GitHub · 99 lines

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

1mo ago First seen · 99 lines · 22 tokens per session scan A 53565b11a3e5

Subscribe to this mod's changes

dependency-version-check is a skill published in the GitHub repository gitricko/hermes-webtop (28 stars, last pushed 4d ago), licensed MIT. It adds 22 tokens to every session and 925 once invoked, about $0.0001 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-10-05.

Containers DevOps and cloud

dependency-version-check next to 6 skills from other repositories
Mod	Type	Stars	Last push	Licence	Scan	Tokens	Works with
dependency-version-checkgitricko/hermes-webtop	Skill	28	4d ago	MIT	A	22	Claude Code, Codex
deploy-docker-composeomnigent-ai/omnigent	Skill	11k	yesterday	Apache-2.0	A	84	Claude Code, Codex
bdd-container-updateNVIDIA-AI-Blueprints/video-search-and-summarization	Skill	2.0k	yesterday	Apache-2.0	A	117	Cursor
securing-kubernetes-on-cloudxalgorix/xalgorix	Skill	1.3k	yesterday	Apache-2.0	A	80	Claude Code, Codex
detecting-privilege-escalation-in-kubernetes-podsxalgorix/xalgorix	Skill	1.3k	yesterday	Apache-2.0	A	40	Claude Code, Codex
docker-socket-mountPurpleAILAB/Decepticon	Skill	6.5k	8d ago	Apache-2.0	B	67	Claude Code
k8s-networkingrohitg00/kubectl-mcp-server	Skill	968	15d ago	MIT	A	34	Claude Code, Codex

hermes-webtop: Skill for Claude Code