Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add voxpelli/claude-beads --skill upstream-trackergit clone --depth 1 https://github.com/voxpelli/claude-beadsWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/voxpelli/claude-beads/upstream-tracker)<a href="https://agentmods.dev/skills/voxpelli/claude-beads/upstream-tracker"><img src="https://agentmods.dev/badge/skills/voxpelli/claude-beads/upstream-tracker.svg" alt="Measured on agentmods" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00186 | $0.06531 |
| Opus 5 | $0.00093 | $0.03266 |
| Sonnet 5 | $0.00037 | $0.01306 |
| Haiku 4.5 | $0.00019 | $0.00653 |
Grade A, and why
upstream-tracker scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 8d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 517 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Upstream Tracker
Manage the UPSTREAM-*.md files that track bugs, feature requests, contribution
opportunities, and friction discovered in upstream packages while building this
project.
Tracking Files
Vendor packages (permanent files)
Vendor packages are declared in .claude/vendor-registry.json (if it exists) as
an array of {prefix, remote, branch, package} objects, or as packages listed under
workspaces in package.json. Each vendor package gets a permanent
UPSTREAM-<package-name>.md tracking file that always exists, even when empty.
To discover which packages are vendors, read .claude/vendor-registry.json if
it exists, or inspect package.json workspaces. If neither is present, ask the
user which packages should be treated as permanent vendor fixtures.
Non-vendor dependencies (ephemeral files)
Any npm dependency can get an UPSTREAM-<package>.md file when you encounter a
bug or limitation worth tracking (e.g., UPSTREAM-umzeption.md). Create the
file on first encounter. Delete the file entirely once all its entries are
resolved — there's no reason to keep an empty tracking file for a regular
dependency. To discover existing non-vendor files, glob for UPSTREAM-*.md and
exclude the known vendor files.
Non-npm tools (ephemeral files)
Tools in the project's environment (Homebrew formulae, GitHub Actions, Docker
images, VSCode extensions) can also accumulate friction worth tracking. Create
an UPSTREAM-<tool-type>--<name>.md file on first encounter, using the same
ephemeral pattern: delete when all entries are resolved. See the file naming
convention in the Guidelines section for the tool-type prefix format.
Shared structure
All upstream files share the same structure: Feature Requests | Bugs | Upstream Opportunities | Cross-Vendor Inconsistencies | Trend Reviews
Non-vendor files typically use Feature Requests, Bugs, and Upstream Opportunities sections (cross-vendor inconsistencies only apply when multiple vendor packages share an API surface).
What ships with it
1 file beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 8d ago First seen · 517 lines · 186 tokens per session scan A c3767fefb306
upstream-tracker is a skill published in the GitHub repository voxpelli/claude-beads (2 stars, last pushed 24d ago), licensed MIT. It adds 186 tokens to every session and 6,531 once invoked, about $0.0009 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
schema-evolve
This skill should be used when the user asks about 'schema drift', 'schema evolution', 'evolve schema', 'schema sync', 'sync schemas', 'update schema fields', 'schema field frequency', 'missing schema fields', 'unused schema fields', 'schema proposal', 'schema cardinality', 'check schema', 'schema audit', 'schema…
knowledge-maintain
This skill should be used when the user asks to fix, repair, or tidy one or more SPECIFIC named notes — 'fix these notes', 'fix the issues in [note]', 'add the missing relations to [note]', 'tidy up [note]', 'fix orphan [note]', 'apply the gardener findings for [note]'. Applies structural fixes (missing sections…
raindrop-triage
This skill should be used when the user asks to 'triage unsorted bookmarks', 'clean up raindrop inbox', 'sort unsorted', 'organize bookmarks', 'raindrop triage', 'process bookmark backlog', 'promote triaged bookmarks', 'classify triaged', 'raindrop cleanup', 'deduplicate bookmarks', 'find duplicate bookmarks', 'tag…
knowledge-garden
This skill should be used when the user asks to audit, health-check, or structurally validate one or more SPECIFIC named notes or a bounded topic cluster — 'audit these notes', 'check this note for orphans or broken links', 'fourth-wall check on [note]', 'validate the structure of [note]', 'spot-check [note]'. Runs a…
knowledge-prime
This skill should be used when the user asks to 'prime context', 'load project knowledge', 'what do we know about this project', 'knowledge brief', 'project context', 'what packages are documented', 'show coverage for this project', 'dependency coverage report', 'which of our deps have notes', 'knowledge primer'…
nudge
This skill (explicit /nudge only) manages Claude Code feature-adoption nudges sourced from the Basic Memory note main/reference/claude-code-noteworthy-features. Bare /nudge = Mode A (sync): re-read the note, filter out features already marked adopted or declined, and regenerate the tip cache…