Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add lttr/claude-marketplace --skill dependency-updategit clone --depth 1 https://github.com/lttr/claude-marketplaceWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/lttr/claude-marketplace/dependency-update)<a href="https://agentmods.dev/skills/lttr/claude-marketplace/dependency-update"><img src="https://agentmods.dev/badge/skills/lttr/claude-marketplace/dependency-update/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/lttr/claude-marketplace/dependency-update"><img src="https://agentmods.dev/badge/skills/lttr/claude-marketplace/dependency-update.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00085 | $0.03632 |
| Opus 5.5 | $0.00034 | $0.01453 |
| Sonnet 5.5 | $0.00017 | $0.00726 |
| Haiku 4.5 | $0.00009 | $0.00363 |
Grade A, and why
dependency-update scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 8d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 291 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Dependency update
One run produces at most one pull request. Apart from the scan script
(${CLAUDE_SKILL_DIR}/scripts/dep-scan.mjs), every step here is a judgement call, not a mechanical
procedure.
Merging the PR may deploy to production, and nothing is automerged. The goal is therefore a PR a tired human can review honestly in a few minutes, not the largest batch that passes CI.
Dry run (/dependency-update dry-run, or any "dry run" / "just report"
phrasing): do §0–§3 strictly read-only — no branch, no install or update, no
edit, commit, push, PR, or run note — then print a report and stop. The
report covers what you would bump and would not, and why (including the
breaking-change evidence for majors), the exact commands §4 would run, the
DELETE-WHEN status, and what even a real run could not verify; state up front
that nothing was verified. Still read the release notes — the value of a dry
run is the reasoning about each update, not the list of versions. Stop
conditions from §0 don't stop a dry run; name them in the report and carry on
scanning. Do not proceed to §4 unless the user asks in a new message.
What this skill does not know
This skill carries the procedure. It does not carry any project's specifics, and it should not be edited to. Before §0, learn them from where that project already enforces them:
- A project skill wrapping this one, if there is one. A repo with real
toolchain constraints is better served by its own skill (
nuxt-deps-updateand the like) that names the run's additional rules and then defers here for the procedure. When you were invoked through such a skill, its rules win over every default below. - The workspace config itself —
pnpm-workspace.yaml, the rootpackage.json. Comments at the point of enforcement are the most reliable source a repo has, because the person editing the pin reads them. - The repo's
CLAUDE.md— especially its verification and shipping sections.
Where none of them answers, use the defaults named below, and say in the PR body which defaults you had to assume.
What ships with it
1 file beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 8d ago Changed · -1 lines b8e564d2f0b6
- 20d ago First seen · 292 lines · 85 tokens per session scan A 7f4f0d72f2de
dependency-update is a skill published in the GitHub repository lttr/claude-marketplace (2 stars, last pushed 7d ago), licensed MIT. It adds 85 tokens to every session and 3,632 once invoked, about $0.0003 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-09-23.
Other skills, from other repositories
ci-validation-gates
Defensive CI/CD patterns: semver validation, token checks, retry logic, and draft detection.
delivery-autopilot
Use when an approved feature or fix should progress to production through governed automation with minimal human intervention. USE FOR: approve-once delivery orchestration, deterministic dry-run rehearsal of status/merge/escalation logic, and policy-aligned remediation payload generation for blocked stages. DO NOT USE…
cli-forge-github
Audit and fix GitHub repository health: rulesets vs CI alignment, branch hygiene, PR lifecycle, release automation flow, permission issues, and transient CI failures. Detects misconfigurations that cause PRs to hang, CI to fail silently, branches to accumulate, and releases to stall. Use when the user says 'PR stuck'…
github-workflows
Use when doing GitHub work end-to-end: auth, repository setup, issue triage, PR implementation, code review, CI monitoring, merge/release, and fallback REST workflows.
abd-devops
ABD DevOps agent: scaffolds CI/CD, validates .env.example coverage, checks Dockerfile hygiene, and handles release tasks.
devops-pipeline
Release engineering including deployment strategies, feature flags, canary releases, blue-green deployments, and rollback procedures. Trigger for release processes, feature flag implementation, or deployment strategy design.