Borrowing it
Nothing to install: this file belongs to PIsberg/vibetags. Take a copy, put it at the same path in your own repository, and replace the rules that are about this project with yours.
curl -O https://raw.githubusercontent.com/PIsberg/vibetags/main/.claude/skills/bump-dependencies/SKILL.mdgit clone --depth 1 https://github.com/PIsberg/vibetagsWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/pisberg/vibetags/bump-dependencies)<a href="https://agentmods.dev/skills/pisberg/vibetags/bump-dependencies"><img src="https://agentmods.dev/badge/skills/pisberg/vibetags/bump-dependencies/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/pisberg/vibetags/bump-dependencies"><img src="https://agentmods.dev/badge/skills/pisberg/vibetags/bump-dependencies.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector pass
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00081 | $0.01333 |
| Opus 5 | $0.00041 | $0.00666 |
| Sonnet 5 | $0.00016 | $0.00267 |
| Haiku 4.5 | $0.00008 | $0.00133 |
Grade A, and why
bump-dependencies scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 10d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 81 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Bump dependencies
Every third-party version lives once, as a <name.version> property in
vibetags-parent/pom.xml; the managed poms inherit it and BuildVersionParityTest fails
the build if a literal creeps back in or a Gradle coordinate drifts. What that test cannot
see is whether the pinned version is current, which is what this skill is for.
Step 1 - Branch, then report
git fetch origin && git checkout -b chore/bump-dependencies-$(date +%F) origin/main
tools/bump-dependencies.sh # read-only; add --include-prereleases to see betas
The script prints one line per property with its Maven Central latest, then the toolchains
pinned outside the parent (Gradle wrapper, Kotlin, Groovy, Scala 2.13). It exits 2 if the
parent gains a *.version property the script has no Maven Central path for: add the path
to its PINS table in the same change, so the report can never silently go stale.
Step 2 - Decide
- Apply stable releases only. Never an alpha, beta, milestone (
M1), RC or-ea, even when Maven Central marks it<latest>; the report already hides them by default. - Read the release notes of anything with a major bump before applying it. Plugins that change how the build runs (compiler, surefire, enforcer, spotbugs, pmd, error-prone, nullaway) can turn a green build red for reasons unrelated to the code; that is not a reason to skip them, it is a reason to run the full gates below.
- Kotlin:
examples/kotlinuses kapt; a Kotlin bump is verified by that example's Gradle build, nothing less.
Step 3 - Apply, including the mirrors
Edit the property in vibetags-parent/pom.xml. Then the places that cannot inherit it:
| Pin | Also lives in |
|---|---|
junit.version, junit.platform.version, mockito.version, archunit.version, async-test-lib.version, snakeyaml.version, logback.version, slf4j.version, jspecify.version |
nothing to edit. vibetags/build.gradle reads each one from the parent via pomVersion(...); BuildVersionParityTest enforces that it keeps doing so |
pmd.version |
nothing. Both Gradle builds derive it from the parent, and BuildVersionParityTest fails any file that reintroduces a literal |
maven-compiler-plugin.version |
literals in examples/basic/pom.xml, examples/multimodule/pom.xml, examples/multimodule-indexed/pom.xml, examples/all-tiers/pom.xml, tools/demo/pom.xml (consumer poms; keep them in step) |
| Gradle wrapper | every gradle-wrapper.properties in the repository - ten of them, not the six this row used to list; enumerate with git ls-files '*gradle-wrapper.properties' rather than trusting the list - plus the version named in docs/DEPENDENCIES.md |
| Kotlin | examples/kotlin/build.gradle.kts (jvm and kapt), the snippets in README.md and examples/kotlin/README.md |
| Groovy, Scala | examples/groovy/build.gradle, examples/scala/build.gradle (Scala stays on the 2.13 line: the example is about Java-only support) |
| pre-commit hook revs | python -m pre_commit autoupdate; the checkstyle hook runs in Docker, so unless Docker is available revert its rev and say so - an unverifiable bump is not a verified one |
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 10d ago First seen · 81 lines · 81 tokens per session scan A 8ab9c072c400
bump-dependencies is a skill published in the GitHub repository PIsberg/vibetags (15 stars, last pushed today), licensed MIT. It adds 81 tokens to every session and 1,333 once invoked, about $0.0004 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
omh-deploy-and-monitor
This is a Hermes-native deploy-and-monitor workflow skill.
version-control-strategy
Define version control for design files, components, and libraries — branching, naming, and release. Use when file history is chaotic. For design system contribution rules, use design-system-governance (design-systems).
git-commit
Generate conventional commit messages for Java projects. Use when user says "commit", "create commit", "commit changes", or after completing code changes that need to be committed.
research-archival
Scrape AI research URLs, archive with frontmatter, create GitHub Issues with identity verification.
debug-systematic
Systematic 4-phase debugging methodology for complex, intermittent, or mysterious issues. Use when investigating bugs, race conditions, or unexplained failures.
monorepo-navigator
Inspect or improve Turborepo, Nx, pnpm, or Lerna monorepos: package boundaries, dependency graphs, selective tests, caching, and migrations.