Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add KhaledSaeed18/dotclaude --skill dependency-upgradegit clone --depth 1 https://github.com/KhaledSaeed18/dotclaudeWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/khaledsaeed18/dotclaude/dependency-upgrade)<a href="https://agentmods.dev/skills/khaledsaeed18/dotclaude/dependency-upgrade"><img src="https://agentmods.dev/badge/skills/khaledsaeed18/dotclaude/dependency-upgrade/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/khaledsaeed18/dotclaude/dependency-upgrade"><img src="https://agentmods.dev/badge/skills/khaledsaeed18/dotclaude/dependency-upgrade.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00119 | $0.01050 |
| Opus 5.5 | $0.00048 | $0.00420 |
| Sonnet 5.5 | $0.00024 | $0.00210 |
| Haiku 4.5 | $0.00012 | $0.00105 |
Grade A, and why
dependency-upgrade scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 28d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 58 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Upgrades fail when they are done all at once and diagnosed all at once. The discipline is: know what changed, change one thing, run the tests, commit, repeat. A day of small green steps beats a week of bisecting a red branch.
Step 1: inventory
npm outdated/pnpm outdated/pip list --outdated/cargo outdated/go list -m -u all, plus the audit:npm audit,pip-audit,cargo audit,govulncheck.- For each candidate: current, latest, is it a major bump, does an advisory apply, is the current version EOL, does it block another upgrade (e.g. the test runner must move before the framework can).
- Classify: security (do first, minimal version that fixes), blocking (needed for another upgrade), major (needs reading), minor/patch (batchable).
Write the plan as a table before touching anything; get agreement if the list is long or a major touches the framework.
Step 2: prepare
- Green baseline: full test suite, typecheck, lint, and build pass on the current commit; record timings.
- A branch per major upgrade; one branch for the minor/patch batch.
- Read, for each major: the release notes for every skipped major, the migration guide, the codemods offered, and the peer dependency changes. Note breaking changes that touch this codebase (grep for the removed APIs).
Step 3: minor and patch batch
Update them together (pnpm update within ranges, pip install -U for the batch), run the gate, commit as one change. If it goes red, bisect the batch by halving.
Step 4: majors, one at a time
For each, in dependency order (tooling first: TypeScript, test runner, bundler; then libraries; then the framework):
- Bump the one package (and its peers that must move with it).
- Run codemods if the project offers them (
npx @next/codemod,npx react-codemod,django-upgrade,pyupgrade,cargo fix --edition). - Typecheck first: it lists the removed and changed APIs faster than tests do.
- Fix compile errors by following the migration guide, not by casting or suppressing.
- Run the tests; fix behaviour changes the guide predicted; investigate any it did not.
- Run the app or the smoke path once by hand where tests are thin.
- Commit with the version range and the changes made in the body.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 28d ago First seen · 58 lines · 119 tokens per session scan A 55d204e71cee
dependency-upgrade is a skill published in the GitHub repository KhaledSaeed18/dotclaude (5 stars, last pushed 6d ago), licensed MIT. It adds 119 tokens to every session and 1,050 once invoked, about $0.0005 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-09-22.
Other skills, from other repositories
qa-testing
Run QA testing on a page, feature, or full site at one of three depth tiers (smoke, standard, full). Use this skill whenever the user asks to QA a page or site, run a smoke test after a deploy, verify a page before launch, or run a regression sweep. Triggers on QA, QA sweep, smoke test, regression test, post-deploy…
visual-qa
Runs rigorous visual QA across web, terminal, and paginated surfaces: an Apple HIG-based checklist, paired light/dark captures at phone and desktop widths, screenshot evidence, and a per-item PASS/FAIL verdict. Use for any UI build or change, or when asked whether a page, component, or TUI looks right or follows the…
remove-ai-slops
Removes AI-generated code smells from branch changes or an explicit file list behind regression tests. Use when the user asks to clean up, deslop, or remove AI-slop patterns from recent changes.
senpi-qa
QA the omo Senpi adapter (packages/omo-senpi, packages/senpi-task) against the REAL senpi binary in strict isolation, and write every artifact to the one canonical evidence path .omo/evidence/omo-senpi-adapter/ /. The live drivers under packages/omo-senpi/scripts/qa/ create their own isolated SENPICODINGAGENTDIR and…
test-coverage-improver
Analyze test coverage gaps and generate tests to improve coverage. Use when improving test coverage, finding untested code, or writing missing tests.
browser-test-loop
Use to actually verify a web change in a real browser instead of assuming it works — click through a flow, catch console errors, check a form submits, confirm a fix on the page. Trigger when a UI change needs proof, a bug only reproduces in the browser, or the user asks to test, check, or screenshot the running app.