Borrowing it
Nothing to install: this file belongs to lkmeta/txtify. Take a copy, put it at the same path in your own repository, and replace the rules that are about this project with yours.
curl -O https://raw.githubusercontent.com/lkmeta/txtify/main/.claude/skills/deps-bump/SKILL.mdgit clone --depth 1 https://github.com/lkmeta/txtifyWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/lkmeta/txtify/deps-bump)<a href="https://agentmods.dev/skills/lkmeta/txtify/deps-bump"><img src="https://agentmods.dev/badge/skills/lkmeta/txtify/deps-bump/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/lkmeta/txtify/deps-bump"><img src="https://agentmods.dev/badge/skills/lkmeta/txtify/deps-bump.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector pass
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00035 | $0.00739 |
| Opus 5.5 | $0.00014 | $0.00296 |
| Sonnet 5.5 | $0.00007 | $0.00148 |
| Haiku 4.5 | $0.00003 | $0.00074 |
Grade A, and why
deps-bump scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured today.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 33 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Dependency updates for Txtify
Ground rules
torchandtorchaudioare pinned as a verified pair, identical inrequirements.txtand the Dockerfile. A bad pair doesn't fail the build — it crashes the worker at import, and jobs just hang at 10%. This is the #1 trap. torchaudio's latest release is 2.11.0 (no newer one as of 2026-10-26), so torch moves ahead alone now (2.14.1 + 2.11.0 verified 2026-10-26). That's only possible because 2.11.0 is built on torch's stable C ABI (*.abi3.so, notorch==pin); if torchaudio ever ships again with an exact torch pin, move both together. Every torch bump must be proven by a real transcription indocker_e2e.sh, not just an import.stable-ts≥ 2.19.1 so pip resolves anopenai-whisperthat builds under modern setuptools (older ones importpkg_resourcesin setup.py and break the Docker build). Check stable-ts'sopenai-whisperconstraint before bumping torch far ahead.- Before adding any package, and before "fixing" an alert on one: check it's actually imported —
grep -rn '<pkg>' src/. Unused packages get deleted, not bumped (transformers/accelerate/srt/webvtt-py died this way). yt-dlprots fastest and breaks YouTube downloads silently. After bumping, verify with a real download (host venv is fine):import yt_dlp opts = {"format": "bestaudio/best", "postprocessors": [{"key": "FFmpegExtractAudio", "preferredcodec": "mp3", "preferredquality": "192"}], "outtmpl": "yt_test.%(ext)s", "quiet": True} yt_dlp.YoutubeDL(opts).download(["https://www.youtube.com/watch?v=jNQXAC9IVRw"]) # 19s clip- Runtime deps go in
requirements.txt; test-only deps (pytest, httpx, pypdf) inrequirements-dev.txt. Don't ship test tooling in the image.
Checking alerts
gh api repos/lkmeta/txtify/dependabot/alerts --paginate \
--jq '.[] | select(.state=="open") | [.security_advisory.severity, .dependency.package.name, .security_vulnerability.vulnerable_version_range, (.security_vulnerability.first_patched_version.identifier // "none")] | @tsv'
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- today Changed 7ba23f120f50
- 1mo ago First seen · 33 lines · 35 tokens per session scan A 8ecace0a8c97
deps-bump is a skill published in the GitHub repository lkmeta/txtify (135 stars, last pushed today), licensed Apache-2.0. It adds 35 tokens to every session and 739 once invoked, about $0.0001 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
background-task
Add or modify work that runs outside the request/response cycle — emails, document ingestion, webhooks, cleanups, scheduled jobs. Use when something is slow or fire-and-forget, or when adding a periodic/cron task. This project's queue is {{ cookiecutter.backgroundtasks }}.
agent-tool
Add a new tool/function the AI agent can call (e.g. look something up, hit an external API, perform an action). Use when extending the assistant's capabilities, wiring a new function into the agent, or when the model needs a new action. This project uses {{ cookiecutter.aiframework }}.
frontend-feature
Build a new page, view, or data-driven feature in the Next.js frontend. Use when adding a route under the dashboard/marketing area, wiring UI to a backend endpoint, adding client state, or creating a localized page. Covers App Router, data fetching, Zustand stores, and i18n.
pytest-suite
Write or extend the backend test suite following this project's conventions. Use when adding tests for a new service/route/repository, when coverage is missing, or when asked to test a feature. Knows the mocked-session + httpx AsyncClient setup so tests run with no database.
rag-knowledge
Work with the RAG knowledge base — ingest documents, run semantic search, manage collections, or add a sync source/connector (Google Drive, S3). Use when populating or debugging the knowledge base, tuning retrieval, or adding a new document source. This project uses {{ cookiecutter.vectorstore }} + {{…
alembic-migration
Create, review, and apply database schema changes with Alembic. Use whenever a SQLAlchemy model is added or changed, a column/index/constraint needs to change, or a data backfill is required — anything that alters the PostgreSQL schema.