nixpkgs-package-upstream

nixpkgs-package-upstream is a skill for Claude Code, Codex from Kihara777/NixKits. It costs 261 tokens per session (9,442 once invoked), scanned C, original, MIT.

A step-by-step guide for submitting a self-built software package to nixpkgs, the package collection used by Nix. It covers checking whether the package is suitable, meeting current review rules, testing the built result, and opening a pull request.

In plain words
What is it for?
Use it to assess a package, inspect its Nix files and metadata, run a realistic build and output check, review the final change, and prepare an upstream pull request.
Why use it?
It reduces the risk of proposing a package that already exists, has licensing problems, fails current checks, or only appears to work because it was not tested properly. It also accounts for changes in the live nixpkgs repository rather than relying on old local copies.

Skill for Claude CodeCodex

Written for no agent in particular: nothing here depends on one. Also seen: positional $N argument.

Good fit Use it to assess a package, inspect its Nix files and metadata, run a realistic build and output check, review the final change, and prepare an upstream pull request.

Compare 6 skills from other repositories ↓
Install with agentmods
npx agentmods add skills/kihara777/nixkits/nixpkgs-package-upstream
Install

Getting it into your agent

One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.

Any agent
npx skills add Kihara777/NixKits --skill nixpkgs-package-upstream
Clone the repo
git clone --depth 1 https://github.com/Kihara777/NixKits

Made for: Claude Code, Codex.

Wrote this? Show the measurements

A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.

agentmods badge for nixpkgs-package-upstream

README.md
[![agentmods](https://agentmods.dev/badge/skills/kihara777/nixkits/nixpkgs-package-upstream/github.svg)](https://agentmods.dev/skills/kihara777/nixkits/nixpkgs-package-upstream)
Your own site
<a href="https://agentmods.dev/skills/kihara777/nixkits/nixpkgs-package-upstream"><img src="https://agentmods.dev/badge/skills/kihara777/nixkits/nixpkgs-package-upstream/github.svg" alt="Measured on agentmods" height="20"></a>

Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.

agentmods 80×15 button for nixpkgs-package-upstream

Your own site · 80×15
<a href="https://agentmods.dev/skills/kihara777/nixkits/nixpkgs-package-upstream"><img src="https://agentmods.dev/badge/skills/kihara777/nixkits/nixpkgs-package-upstream.svg" alt="Reviewed on agentmods" width="80" height="20"></a>
Per session 261 Skills are progressive disclosure: only the name and description are preloaded; the body loads when the skill is used.
When invoked 9,442 The whole file, excluding the scripts and references it only reads on demand.
Security scan C 1 finding. A grade says what 26 rules found in the file — not that it is safe.
Origin original No closer match found in the catalogue.
Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

ModelPer sessionOnce invoked
Fable 5.1 $0.00261 $0.09442
Opus 5.5 $0.00104 $0.03777
Sonnet 5.5 $0.00052 $0.01888
Haiku 4.5 $0.00026 $0.00944

Measured 3d ago against content hash 976f288fd913, method: parsed. Prices are Anthropic first-party input rates as of 2026-10-07, from the pricing page.

Security

Grade C, and why

nixpkgs-package-upstream scanned grade C with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 3d ago.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Harvests environment variableshighData exfiltration

Enumerating or grepping the environment for keys collects credentials unrelated to what the mod says it does.

env = os.environ.copy()
skills/nixpkgs-package-upstream/SKILL.md · 637 lines

How it starts

The opening of the file, as written. The whole thing — 637 lines — stays where its author put it; the contents beside it link to each section on GitHub.

把软件包提交到上游 nixpkgs(通用)

把仓库里自己打的包变成 nixpkgs 的一部分。

本技能只包含与仓库无关的通用方法。仓库特有的环节(多语文档同步、维护日志、 自检登记等)由仓库适配层提供——见文末。

顺序不能换:评估 → 审计 → dry-run → 实操。跳步的代价在最后一节。


第 0 步:先同步,再采信

任何「现在的 nixpkgs 是什么样」的结论,都要现取。

gh api repos/NixOS/nixpkgs/commits --jq '.[0].sha'   # 取 HEAD,写进你的报告

走过的坑:本地那份 nixpkgs 快照的 CONTRIBUTING.md 里没有 AI 政策一节, 而 upstream master 里有。凭快照下结论就会漏掉整条最关键的硬要求。 文档结构会漂移——doc/contributing/ 目录现在已不存在, 只剩一个跳转存根 doc/contributing.md。路径必须实测,不能凭记忆。

同时把基线写进报告:哪一刻、哪个 commit。这决定了你的结论什么时候过期。


第 1 步:评估可行性(每个包一条,逐条给证据)

六问,任一答「否」就先别做:

① 它已经在 nixpkgs 里了吗?

gh api "repos/NixOS/nixpkgs/contents/pkgs/by-name/${shard}/${name}/package.nix?ref=master"
# 404 = 不在。200 = 在,那就只能提 update,不能提 init。

shard = 包名前两个字符的小写。别只查这一条路径—— 包也可能在类别目录里(pkgs/<类别>/<包名>/default.nix)。 再用属性名求值一次最稳:

nix eval --raw "path:<nixpkgs>#${name}.name"   # 报 NOT-A-PACKAGE 就是没有

② 曾经进过 nixpkgs、后来被删了吗?

gh api -X GET search/commits -f q="repo:NixOS/nixpkgs ${name}" --jq .total_count
gh api -X GET search/issues  -f q="repo:NixOS/nixpkgs ${name}" --jq .total_count

被删过的要先找删除理由(通常 包名: remove),理由可能就是现在仍然成立的理由。 搜索全 0 也不能反过来说「绝不存在过」—— 证据为负不是证明,要在报告里把这个区别写清楚。

走过的坑:一个包定义里的注释写着「nixpkgs 已不再提供它」, 而九条独立取证全是 0。真实来源是我们自己仓库的 CI workflow 记混了。 仓库里的自述会过期,它不是证据。

③ 有在途 PR 吗? 这一条最容易白干。

gh api -X GET search/issues -f q="repo:NixOS/nixpkgs is:pr ${name}" --jq '.total_count, .items[].title'

要按「上游项目名」而不是「我们的包名」搜。 同一个软件的包名可能是别的写法—— 见过的实例:我们叫 dsh,nixpkgs 里三个在途 PR 都叫 deepseek-harness。

④ 许可能指认吗?——必须是那个 tag 里的文件

这是最容易被跳过、也最容易被审阅者当场卡住的一条。

要检查的是「我们实际取源的那个 tag/rev」里有没有许可,不是仓库的 main 分支。

走过的坑:某个包的 main 上有 LICENSE(最近才加的), 而我们取源的 tag 比那次提交早十八天——tag 里没有许可文件。

但「没有 LICENSE 文件」不等于「没有许可」。 先找这三处,再决定要不要向上游要:

  1. 源文件头:# SPDX-License-Identifier: <SPDX 表达式>。 直接在构建出来的产物里 grep(grep -rl SPDX-License-Identifier $out), 比读仓库可靠——它证明的是我们真正取到的那份源码。
  2. 清单文件:Python 的 pyproject.toml、Blender 插件的 blender_manifest.toml、 Node 的 package.json 等,常带 license / SPDX 字段。
  3. 上游 issue 里有没有人问过:搜 license,看维护者怎么答的。 先例:某包有人提过「仓库没有许可文件」,维护者回 「licence is in the individual files」并随后补了 LICENSE——那条 issue 就是最有力的依据, 引它比引 main 上那份后加的文件强得多,而且说明不需要再开一条(有人做过的事不要重复做)。

Read the full file on GitHub · 637 lines

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

  1. 3d ago Changed · +57 lines 976f288fd913
  2. 5d ago First seen · 580 lines · 261 tokens per session scan C 281e912f0fab

Subscribe to this mod's changes

nixpkgs-package-upstream is a skill published in the GitHub repository Kihara777/NixKits (28 stars, last pushed yesterday), licensed MIT. It adds 261 tokens to every session and 9,442 once invoked, about $0.0010 per session on Opus 5.5. A static security scan graded it C with 1 finding (harvests environment variables). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-10-11.

Related

Other skills, from other repositories

git-commit

A guided Git commit workflow that examines changes and creates a commit message using the Conventional Commits format, a shared style for labeling changes such as features, fixes, tests, or documentation.

adongwanai/learn-workbuddy · 0 tokens

git-master

Advanced Git operations — rebase, squash, fixup, blame, bisect, reflog, code archaeology (git log -S/-G), worktrees. Use when the task mentions rebase, squash, bisect, blame, reflog, fixup, finding deleted code, tracing commit history, cleaning up a branch, or recovering lost work.

znlgis/my-opencode-deepseek-config · 75 tokens

to-tickets

A workflow for turning a written plan or specification into separate GitHub issues, with each issue covering one independently finishable piece of work.

znlgis/my-opencode-deepseek-config · 60 tokens

git-expert

Expert-level Git version control with advanced workflows, branching strategies, and best practices for team collaboration. Use when the user mentions version control, collaboration, or workflow, or when the task involves Essential Git Commands, Advanced Git Techniques, Branching Strategies, or Conflict Resolution.

personamanagmentlayer/pcl · 57 tokens

commit-message

Guidance for writing Git commit messages using Conventional Commits, a common format such as fix, feat, or docs followed by a short description. It focuses on explaining why a change was made.

pingfanfan/hello-dsh · 43 tokens

gh-cli

Standardize all GitHub work via gh CLI (repos, issues, PRs, reviews, Actions, labels, releases). Trigger on any GitHub URL (incl. deep links like /pull/123, /issues/123.

alyraffauf/hoenn · 52 tokens