Borrowing it
Nothing to install: this file belongs to hardwood-hq/hardwood. Take a copy, put it at the same path in your own repository, and replace the rules that are about this project with yours.
curl -O https://raw.githubusercontent.com/hardwood-hq/hardwood/main/.claude/skills/hardwood-dependency-updates/SKILL.mdgit clone --depth 1 https://github.com/hardwood-hq/hardwoodWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/hardwood-hq/hardwood/hardwood-dependency-updates)<a href="https://agentmods.dev/skills/hardwood-hq/hardwood/hardwood-dependency-updates"><img src="https://agentmods.dev/badge/skills/hardwood-hq/hardwood/hardwood-dependency-updates/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/hardwood-hq/hardwood/hardwood-dependency-updates"><img src="https://agentmods.dev/badge/skills/hardwood-hq/hardwood/hardwood-dependency-updates.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00102 | $0.01474 |
| Opus 5.5 | $0.00041 | $0.00590 |
| Sonnet 5.5 | $0.00020 | $0.00295 |
| Haiku 4.5 | $0.00010 | $0.00147 |
Grade A, and why
hardwood-dependency-updates scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 6d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 81 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Hardwood dependency updates
Dependabot (.github/dependabot.yml) opens weekly PRs once a release is seven days old (cooldown; security updates come at once): one grouped PR for minor and patch Maven updates, one per major Maven update, one grouped PR for actions, and Docker base-image updates. Merging them one by one leaves main broken between merges and hides why an update was skipped. This skill folds them into one PR of a few commits, each a group a reviewer can judge on its own.
1. Collect
gh pr list --author app/dependabot --state open --json number,title,headRefName,files
gh pr diff <N>
Classify every updated artifact by where it ends up, checked in the POMs (scope, module, whether the module is deployed: maven.deploy.skip), not by its name:
| Commit | Contents |
|---|---|
| Library dependencies | Runtime dependencies of the published modules (bom/pom.xml, aws-auth, avro, …): what reaches users' classpaths |
| CLI dependencies | cli/pom.xml: what ships in the native binary and the image |
| Build | Maven (wrapper), Maven plug-ins, Error Prone |
| Test dependencies | test-bom/pom.xml, test-scoped dependencies, modules that are not deployed |
The actions PR touches .github/workflows/, which cannot be pushed from the container. Review its majors' release notes against the workflows (hardwood-supply-chain-check, area 1) and let the user merge it as is.
2. Issue and branch
Agree the issue with the user first (CLAUDE.md). Frame it as a routine dependency update; list the versions and, once known, what was held back and why. Work in a worktree named after the branch (<issue>-dependency-updates).
3. Apply, one group per commit
Edit the versions by hand (exact-match replacements), not by merging Dependabot branches: their grouped diffs also carry unrelated churn, such as a rewritten mvnw.cmd. For a Maven update, take the wrapper's SHA-256 from a distribution verified against Apache's signature and SHA-512 (hardwood-supply-chain-check, area 3).
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 6d ago First seen · 81 lines · 102 tokens per session scan A afe6909a8c17
hardwood-dependency-updates is a skill published in the GitHub repository hardwood-hq/hardwood (417 stars, last pushed 4d ago), licensed Apache-2.0. It adds 102 tokens to every session and 1,474 once invoked, about $0.0004 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-10-23.
Other skills, from other repositories
deployment-patterns
Deployment workflows, CI/CD pipeline patterns, Docker containerization, health checks, rollback strategies, and production readiness checklists for web applications. Use when setting up deployment infrastructure or planning releases.
agent-github-modes
Agent skill for github-modes - invoke with $agent-github-modes.
baby-sit
Monitor a GitHub pull request until CI is green, diagnose failures, and rerun only evidence-backed flaky GitHub Actions jobs.
chinese-git-workflow
A reference for configuring Git with Chinese code-hosting services such as Gitee, Coding.net, GitLab China, and CNB, including SSH, HTTPS, credentials, CI, and repository mirroring.
atmos-hooks
Atmos hooks: lifecycle events, hook kinds, command/store/git/security hooks, step/steps hooks, when: conditions, scoping and overrides, toolchain integration, --skip-hooks, and Atmos Pro/local output.
atmos-pro
Atmos Pro setup and workflows: settings.pro, GitHub OIDC, affected and inventory uploads, stack locks, pro commit, workflow dispatch, merge queues, and drift detection.