What is ak-upstream-status?

A report of outstanding work sent to upstream projects that Agentic Kit depends on. Upstream projects are the external repositories where those dependencies are developed.

Use it to report open upstream issues and their links, review counts by project, and identify items waiting for an external maintainer.

It gives maintainers one view of filed, commented-on, or referenced threads and shows whether the scheduled check is current. It also explains when only locally recorded information is available.

How pacphi/agentic-kit configures Claude Code and Codex

Reuse

Borrowing it

Nothing to install: this file belongs to pacphi/agentic-kit. Take a copy, put it at the same path in your own repository, and replace the rules that are about this project with yours.

Copy the file

curl -O https://raw.githubusercontent.com/pacphi/agentic-kit/main/.agents/skills/ak-upstream-status/SKILL.md

Clone the repo

git clone --depth 1 https://github.com/pacphi/agentic-kit

Made for: Claude Code, Codex.

Wrote this? Show the measurements

A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.

README.md

[![agentmods](https://agentmods.dev/badge/skills/pacphi/agentic-kit/ak-upstream-status/github.svg)](https://agentmods.dev/skills/pacphi/agentic-kit/ak-upstream-status)

Your own site

<a href="https://agentmods.dev/skills/pacphi/agentic-kit/ak-upstream-status"><img src="https://agentmods.dev/badge/skills/pacphi/agentic-kit/ak-upstream-status/github.svg" alt="Measured on agentmods" height="20"></a>

Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.

Your own site · 80×15

<a href="https://agentmods.dev/skills/pacphi/agentic-kit/ak-upstream-status"><img src="https://agentmods.dev/badge/skills/pacphi/agentic-kit/ak-upstream-status.svg" alt="Reviewed on agentmods" width="80" height="20"></a>

Per session 83 Skills are progressive disclosure: only the name and description are preloaded; the body loads when the skill is used.

When invoked 1,243 The whole file, excluding the scripts and references it only reads on demand.

Security scan A 0 findings. A grade says what 26 rules found in the file — not that it is safe.

Origin original No closer match found in the catalogue.

Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

Model	Per session	Once invoked
Fable 5.1	$0.00083	$0.01243
Opus 5.5	$0.00033	$0.00497
Sonnet 5.5	$0.00017	$0.00249
Haiku 4.5	$0.00008	$0.00124

Measured 23d ago against content hash 3fb1095554bc, method: parsed. Prices are Anthropic first-party input rates as of 2026-10-07, from the pricing page.

Security

Grade A, and why

ak-upstream-status scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 23d ago.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Nothing flagged

None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.

.agents/skills/ak-upstream-status/SKILL.md · 86 lines

How it starts

The opening of the file, as written. The whole thing — 86 lines — stays where its author put it; the contents beside it link to each section on GitHub.

Upstream status

agentic-kit keeps one upstream registry, src/lib/hook-audit/agentic-dependency-constraints.json: dependency policies, constraints, and the watch list of upstream threads. scripts/upstream-watch.mjs checks the registry against GitHub and npm. report, check and ledger only read. record fires the paid dispatch routine and builds a local ledger commit; it is the daily workflow's command, so never run it without --dry-run.

When asked for upstream status or a report

From the repository root, run:
```
node scripts/upstream-watch.mjs report --json
```
It exits 0 unless the command line is wrong.
- If registry.status is not valid, report registry.errors and stop.
- If mode is offline, say why (offlineReason, usually: run gh auth login) and that only what the registry records is shown.
Give the counts first, in plain language, from counts. Leave out groups with zero items. Then say when the scheduled watch last succeeded (lastRun); say so plainly when it is more than 48 hours ago, unknown, or there is none (lastRun is null).
Then list the action items with their links, one report group at a time, in this order (the report's group titles):
- "Could not check" first, each thread with its error from fetchErrors. When the thread itself could not be read nothing about it is known; when only its release could not be confirmed, its other groups still hold;
- "Needs our reply";
- "Released and actionable";
- "Released, fix not confirmed": offer to confirm by hand and record minVersion; never dispatch it;
- "Fixed upstream, ak still carries the workaround";
- "Reopened upstream after ak recorded a fix";
- "Closed upstream as not planned";
- "No upstream activity for the stale limit";
- "Waiting on upstream": every thread, never a count alone. Group them by repository, largest first, and give each as #number, title (relation, last upstream update) with its link. The relation is filed, commented or referenced, from the item's relation; the date is upstream.updatedAt, which can include our own comments or bots, so say so and offer to pull the latest comments when asked who replied last. The maintainer uses this list to pick threads to fix in a fork and open a pull request against, or to prod;
- "Ready to retire";
- "Constraints past their retest date";
- "Our tracking issues".

Read the full file on GitHub · 86 lines

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

23d ago First seen · 86 lines · 83 tokens per session scan A 3fb1095554bc

Subscribe to this mod's changes

ak-upstream-status is a skill published in the GitHub repository pacphi/agentic-kit (61 stars, last pushed yesterday), licensed MIT. It adds 83 tokens to every session and 1,243 once invoked, about $0.0003 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-10-05.

Claude Code Project management anthropic claude developer-tools mcp nodejs

docs-governance

Route broad documentation-governance requests to existing ECC skills and run an opt-in, read-only audit of mapped documentation roles, links, ADR indexes, and evidence references. Use when a user asks for documentation governance, project-knowledge organization, documentation integrity, or a deterministic docs audit…

affaan-m/ECC · 67 tokens

notion

Search, read, create, and update Notion pages via the Notion MCP.

asgeirtj/system_prompts_leaks · 20 tokens

parallel-feature-development

Coordinate parallel feature development with file ownership strategies, conflict avoidance rules, and integration patterns for multi-agent implementation. Use this skill when decomposing a large feature into independent work streams, when two or more agents need to implement different layers of the same system…

wshobson/agents · 105 tokens

agentic-kit: Skill for Claude Code