dep-vega

dep-vega is a skill for Claude Code, Codex from HomenShum/NodeBenchAI. It costs 80 tokens per session (1,493 once invoked), scanned A, original, MIT.

A runbook for updating the Vega family of data-visualization packages: Vega, Vega-Lite, and Vega-Embed. It also covers updating the schema reference used by charts and addressing a known cross-site scripting security issue.

In plain words
What is it for?
Use it when upgrading any of the three packages or responding to the specified Vega security alert.
Why use it?
These packages work together, so updating only one can cause installation or chart-rendering failures.

Skill for Claude CodeCodex

Install

Getting it into your agent

One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.

agentmods
npx agentmods add skills/homenshum/nodebenchai/dep-vega
Any agent
npx skills add HomenShum/NodeBenchAI --skill dep-vega
Clone the repo
git clone --depth 1 https://github.com/HomenShum/NodeBenchAI

Made for: Claude Code, Codex.

Wrote this? Show the measurements

A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.

agentmods badge for dep-vega

README.md
[![agentmods](https://agentmods.dev/badge/skills/homenshum/nodebenchai/dep-vega.svg)](https://agentmods.dev/skills/homenshum/nodebenchai/dep-vega)
Your own site
<a href="https://agentmods.dev/skills/homenshum/nodebenchai/dep-vega"><img src="https://agentmods.dev/badge/skills/homenshum/nodebenchai/dep-vega.svg" alt="Measured on agentmods" height="20"></a>
Per session 80 Skills are progressive disclosure: only the name and description are preloaded; the body loads when the skill is used.
When invoked 1,493 The whole file, excluding the scripts and references it only reads on demand.
Security scan A 0 findings. Scan, not verified.
Origin original No closer match found in the catalogue.
Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

ModelPer sessionOnce invoked
Fable 5 $0.00080 $0.01493
Opus 5 $0.00040 $0.00746
Sonnet 5 $0.00016 $0.00299
Haiku 4.5 $0.00008 $0.00149

Measured 5d ago against content hash 8c976f94a432, method: parsed. Prices are Anthropic first-party input rates as of 2026-08-30, from the pricing page.

Security

Grade A, and why

dep-vega scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 5d ago.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Nothing flagged

None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.

.claude/skills/dep-vega/SKILL.md · 128 lines

How it starts

The opening of the file, as written. The whole thing — 128 lines — stays where its author put it; the contents beside it link to each section on GitHub.

vega ecosystem coordinated-bump runbook

Last verified

  • Working versions (since 2026-04-26):
    • vega: ^6.2.0
    • vega-lite: ^6.4.3
    • vega-embed: ^7.1.0
  • Schema URL in SafeVegaChart.tsx: https://vega.github.io/schema/vega-lite/v6.json

Why these three move together

The vega family has tight peer-dependency coupling:

  • vega-lite peers on vega: ^6.0.0
  • vega-embed peers on vega: * and vega-lite: * (loose, but in practice tracks majors)
  • The Vega-Lite spec schema URL is version-locked in our component code

Bumping any one without the others either fails install (peer error) or runtime-fails when the schema URL doesn't match the installed Vega-Lite.

The 2026-04-26 bump in PR #124 was driven by CVE-2025-59840 — a HIGH XSS vulnerability via expression abuse with VEGA_DEBUG.toString calls, fixed in [email protected].

Coupled bumps (always do all three at once)

"vega":         "^6.2.0",
"vega-embed":   "^7.1.0",
"vega-lite":    "^6.4.3"

Plus a schema URL update in code (see Recipe Step 3).

Recipe (bumping to a newer 6.x or 7.x)

Step 1 — Verify peer compatibility

npm view vega-lite@<target> peerDependencies      # confirm "vega: ^6.0.0" range
npm view vega-embed@<target> peerDependencies     # usually "vega: *", "vega-lite: *"

Step 2 — Bump all three in package.json

-"vega":         "^6.2.0",
-"vega-embed":   "^7.1.0",
-"vega-lite":    "^6.4.3",
+"vega":         "^6.X.0",
+"vega-embed":   "^7.X.0",
+"vega-lite":    "^6.X.0",

Then npm install.

Step 3 — Update spec schema URL (if vega-lite major changed)

If vega-lite major version changed (5 → 6 or 6 → 7), update the schema URL in SafeVegaChart.tsx:

- (spec as any).$schema = "https://vega.github.io/schema/vega-lite/v6.json";
+ (spec as any).$schema = "https://vega.github.io/schema/vega-lite/v7.json";

Read the full file on GitHub · 128 lines

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

  1. 5d ago First seen · 128 lines · 80 tokens per session scan A 8c976f94a432

Subscribe to this mod's changes

dep-vega is a skill published in the GitHub repository HomenShum/NodeBenchAI (14 stars, last pushed 21d ago), licensed MIT. It adds 80 tokens to every session and 1,493 once invoked, about $0.0004 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.

Related

Other skills, from other repositories

convex-create-component

Designs and builds Convex components with isolated tables, clear boundaries, and app-facing wrappers. Use this skill when creating a new Convex component, extracting reusable backend logic into a component, building a third-party integration that owns its own tables, packaging Convex functionality for reuse, or when…

get-convex/convex-backend · 95 tokens

convex-quickstart

Initializes a new Convex project from scratch or adds Convex to an existing app. Use this skill when starting a new project with Convex, scaffolding with npm create convex@latest, adding Convex to an existing React, Next.js, Vue, Svelte, or other frontend, wiring up ConvexProvider, configuring environment variables…

get-convex/convex-backend · 108 tokens

convex-performance-audit

Audits and optimizes Convex application performance across hot-path reads, write contention, subscription cost, and function limits. Use this skill when a Convex feature is slow or expensive, npx convex insights shows high bytes or documents read, OCC conflict errors or mutation retries appear, subscriptions or UI…

get-convex/convex-backend · 97 tokens

convex-setup-auth

Sets up Convex authentication with user management, identity mapping, and access control. Use this skill when adding login or signup to a Convex app, configuring Convex Auth, Clerk, WorkOS AuthKit, Auth0, or custom JWT providers, wiring auth.config.ts, protecting queries and mutations with ctx.auth.getUserIdentity()…

get-convex/convex-backend · 105 tokens

convex-migration-helper

Plans and executes safe Convex schema and data migrations using the widen-migrate-narrow workflow and the @convex-dev/migrations component. Use this skill when a deployment fails schema validation, existing documents need backfilling, fields need adding or removing or changing type, tables need splitting or merging…

get-convex/convex-backend · 102 tokens

robel-auth

Integrate and maintain Robelest Convex Auth in apps by always checking upstream before implementation. Use when adding auth setup, updating auth wiring, migrating between upstream patterns, or troubleshooting @robelest/convex-auth behavior across projects.

waynesutton/markdown-site · 52 tokens