Borrowing it
Nothing to install: this file belongs to lkmeta/txtify. Take a copy, put it at the same path in your own repository, and replace the rules that are about this project with yours.
curl -O https://raw.githubusercontent.com/lkmeta/txtify/main/.claude/skills/deps-bump/SKILL.mdgit clone --depth 1 https://github.com/lkmeta/txtifyWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/lkmeta/txtify/deps-bump)<a href="https://agentmods.dev/skills/lkmeta/txtify/deps-bump"><img src="https://agentmods.dev/badge/skills/lkmeta/txtify/deps-bump.svg" alt="Measured on agentmods" height="20"></a>- NVIDIA SkillSpector pass
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00035 | $0.00600 |
| Opus 5 | $0.00017 | $0.00300 |
| Sonnet 5 | $0.00007 | $0.00120 |
| Haiku 4.5 | $0.00003 | $0.00060 |
Grade A, and why
deps-bump scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 8d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 33 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Dependency updates for Txtify
Ground rules
torchandtorchaudiomove together, same version. A mismatch doesn't fail the build — it crashes the worker at import, and jobs just hang at 10%. This is the #1 trap.stable-ts≥ 2.19.1 so pip resolves anopenai-whisperthat builds under modern setuptools (older ones importpkg_resourcesin setup.py and break the Docker build). Check stable-ts'sopenai-whisperconstraint before bumping torch far ahead.- Before adding any package, and before "fixing" an alert on one: check it's actually imported —
grep -rn '<pkg>' src/. Unused packages get deleted, not bumped (transformers/accelerate/srt/webvtt-py died this way). yt-dlprots fastest and breaks YouTube downloads silently. After bumping, verify with a real download (host venv is fine):import yt_dlp opts = {"format": "bestaudio/best", "postprocessors": [{"key": "FFmpegExtractAudio", "preferredcodec": "mp3", "preferredquality": "192"}], "outtmpl": "yt_test.%(ext)s", "quiet": True} yt_dlp.YoutubeDL(opts).download(["https://www.youtube.com/watch?v=jNQXAC9IVRw"]) # 19s clip- Runtime deps go in
requirements.txt; test-only deps (pytest, httpx, pypdf) inrequirements-dev.txt. Don't ship test tooling in the image.
Checking alerts
gh api repos/lkmeta/txtify/dependabot/alerts --paginate \
--jq '.[] | select(.state=="open") | [.security_advisory.severity, .dependency.package.name, .security_vulnerability.vulnerable_version_range, (.security_vulnerability.first_patched_version.identifier // "none")] | @tsv'
Pick the newest version that is explicitly patched in the alert set rather than blindly taking latest — conservative for the ML stack, current for everything else. Alerts auto-resolve after GitHub rescans the updated manifest (minutes to hours); don't chase the counter.
Verification (non-negotiable)
Any requirements.txt change requires the full Docker E2E — the unit tests stub the ML stack and will pass even when the worker can't import: run the verify skill, Tier 2 (./scripts/docker_e2e.sh → PASS: docker E2E complete).
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 8d ago First seen · 33 lines · 35 tokens per session scan A 8ecace0a8c97
deps-bump is a skill published in the GitHub repository lkmeta/txtify (135 stars, last pushed 23d ago), licensed Apache-2.0. It adds 35 tokens to every session and 600 once invoked, about $0.0002 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
background-task
Add or modify work that runs outside the request/response cycle — emails, document ingestion, webhooks, cleanups, scheduled jobs. Use when something is slow or fire-and-forget, or when adding a periodic/cron task. This project's queue is {{ cookiecutter.backgroundtasks }}.
agent-tool
Add a new tool/function the AI agent can call (e.g. look something up, hit an external API, perform an action). Use when extending the assistant's capabilities, wiring a new function into the agent, or when the model needs a new action. This project uses {{ cookiecutter.aiframework }}.
frontend-feature
Build a new page, view, or data-driven feature in the Next.js frontend. Use when adding a route under the dashboard/marketing area, wiring UI to a backend endpoint, adding client state, or creating a localized page. Covers App Router, data fetching, Zustand stores, and i18n.
rag-knowledge
Work with the RAG knowledge base — ingest documents, run semantic search, manage collections, or add a sync source/connector (Google Drive, S3). Use when populating or debugging the knowledge base, tuning retrieval, or adding a new document source. This project uses {{ cookiecutter.vectorstore }} + {{…
alembic-migration
Create, review, and apply database schema changes with Alembic. Use whenever a SQLAlchemy model is added or changed, a column/index/constraint needs to change, or a data backfill is required — anything that alters the PostgreSQL schema.
channel-bot
Work with messaging-channel bots (Telegram / Slack) — register a bot, route inbound messages through the AI agent, handle webhooks vs polling, or add a new channel adapter. Use when wiring chat into a messaging platform or debugging bot delivery.