Skills dependency-upgrade

📦

dependency-upgrade

Name: dependency-upgrade
Author: wshobson

Content revision r1 Medium Risk ⚙️ External commands🌐 Network access📁 Filesystem access

Plan Major Dependency Upgrades

Major dependency upgrades can break builds, tests, and runtime behavior. This skill structures the work into analysis, staged updates, validation, automation, and rollback.

Supports: Claude Codex Code(CC)

📊 69 Adequate

Maintain this Skill? Claim it 📊 69 Adequate

Install with my Agent

Copy this request to your Agent. It includes the canonical Skill page and manifest.

Agent request

Review the Skillstore skill "dependency-upgrade" from https://skillstore.io/skills/wshobson-dependency-upgrade.md and its manifest at https://skillstore.io/api/skills/wshobson-dependency-upgrade/manifest. Verify the artifact. You may proceed after verification, subject to the environment's own policy.

Your Agent should still show its plan and request any confirmation required by the security policy.

Agent-readable resources

Use these links when an AI agent, crawler, or script needs clean context instead of reading the full page.

Markdown detail GET /skills/wshobson-dependency-upgrade.md Signed manifest GET /api/skills/wshobson-dependency-upgrade/manifest Signed lockfile GET /api/skills/wshobson-dependency-upgrade/lockfile

Test it

Using "dependency-upgrade". Upgrade React 17 to React 18 in a TypeScript app.

Expected outcome:

A staged upgrade order with React, React DOM, routing, testing libraries, and build tooling.
A compatibility checklist for peer dependencies and changed APIs.
A validation plan covering build, tests, visual checks, and rollback.

Using "dependency-upgrade". A dependency audit found a vulnerable package that needs a major update.

Expected outcome:

A risk summary for the vulnerable package and dependent libraries.
A plan to update one major version at a time with test checkpoints.
A review list for changelog notes, peer warnings, and lock file changes.

Using "dependency-upgrade". Set up automated dependency update rules for a team repository.

Expected outcome:

A policy that automates low-risk updates and routes major changes for review.
Suggested labels, schedules, reviewer expectations, and merge conditions.
A warning list for peer dependency conflicts and failing test gates.

Security Audit

Medium Risk

v9 • 7/7/2026 Open versioned report

Most static external-command findings are false positives caused by Markdown code fences, not actual Ruby or shell backtick execution. No evidence found for prompt injection, credential exfiltration, or hidden malicious instructions. The skill includes legitimate high-impact package, network, and filesystem examples, so users should review commands and diffs before execution.

Files scanned

410

Lines analyzed

Review items

False positives ignored

Confirmed security concerns (1)

Medium

SKILL.md:37-49 SKILL.md:115-132 SKILL.md:298-319 SKILL.md:336-341

High-Impact Upgrade Commands Require Guardrails

SKILL.md includes commands that update packages, run remote package executables, use force install flags, and delete an upgrade branch. These are legitimate upgrade actions but can modify project state or hide dependency conflicts if run without review.

The cited lines contain explicit npm, npx, git, and force-install commands. The guidance is relevant to dependency upgrades, so the risk is operational rather than malicious.

Capability review items (5)

These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.

Medium

SKILL.md:185

Node.js fs operations

let content = fs.readFileSync(file, 'utf8');

The migration script example reads project files matched by a glob. It is legitimate migration guidance, but it can access local source files if users run the example.

Medium

SKILL.md:199

Node.js fs operations

fs.writeFileSync(file, content);

The migration script example writes modified content back to source files. This is expected for codemods, but it can overwrite project files without a dry run or review.

Medium

SKILL.md:185

Synchronous file operations

let content = fs.readFileSync(file, 'utf8');

The migration script example reads project files matched by a glob. It is legitimate migration guidance, but it can access local source files if users run the example.

Medium

SKILL.md:199

Synchronous file operations

fs.writeFileSync(file, content);

The migration script example writes modified content back to source files. This is expected for codemods, but it can overwrite project files without a dry run or review.

Low

SKILL.md:162

Hardcoded URL

curl https://raw.githubusercontent.com/facebook/react/main/CHANGELOG.md

The skill shows a curl command to fetch a React changelog from a hardcoded GitHub URL. The target is public documentation, but executing it still requires external network access and review.

Risk Factors

⚙️ External commands (42)

🌐 Network access (1)

SKILL.md:162

📁 Filesystem access (4)

SKILL.md:185 SKILL.md:199 SKILL.md:185 SKILL.md:199

Audited by: codex View Audit History →

Share & cite this report

Share the versioned assessment report, neutral badge, embed card, and citations. Skillstore reports evidence without deciding whether this Skill is safe.

Open versioned report

Copy report link

https://skillstore.io/skills/wshobson-dependency-upgrade/audits/9?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_report

Markdown badge

[![Skillstore security assessment](https://skillstore.io/badges/skills/wshobson-dependency-upgrade/security.svg)](https://skillstore.io/skills/wshobson-dependency-upgrade?utm_source=security_passport_badge)

HTML badge

<a href="https://skillstore.io/skills/wshobson-dependency-upgrade?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/wshobson-dependency-upgrade/security.svg" alt="Skillstore security assessment" loading="lazy"></a>

Embed card

<iframe src="https://skillstore.io/embed/skills/wshobson-dependency-upgrade.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>

Academic citations (APA · BibTeX · CFF)

APA citation

wshobson. (2026). dependency-upgrade security audit report (audit version 9) [Author version unspecified]. Skillstore. https://skillstore.io/skills/wshobson-dependency-upgrade/audits/9

BibTeX citation

@techreport{wshobson-wshobson-dependency-upgrade-2026,
  author = {wshobson},
  title = {dependency-upgrade security audit report (audit version 9)},
  institution = {Skillstore},
  year = {2026},
  number = {9},
  url = {https://skillstore.io/skills/wshobson-dependency-upgrade/audits/9},
  note = {Author version unspecified}
}

CITATION.cff

cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "dependency-upgrade security audit report (audit version 9)"
version: "unspecified"
type: report
authors:
  - name: "wshobson"
date-released: "2026-07-07"
url: "https://skillstore.io/skills/wshobson-dependency-upgrade/audits/9"
identifiers:
  - type: other
    value: "skillstore:wshobson-dependency-upgrade:audit:9"
    description: "Skillstore immutable audit report identifier"

Compare variants

3 installable variants

Each author remains a separate installable skill. The recommended variant is ranked by Skillstore evidence.

Why this variant is first

Stronger evidence confidence

Author / source Skillstore Score Evidence Confidence Skillstore usage Updated

sickn33 Recommended

sickn33-dependency-upgrade

Skillstore Score 78

Evidence Confidence High

Skillstore usage 13

Updated

2026-09-09

agentkitco

agentkitco-dependency-upgrade

Skillstore Score 78

Evidence Confidence Medium

Skillstore usage Unknown

Updated

2026-10-17

wshobson Current

wshobson-dependency-upgrade

Skillstore Score 69

Evidence Confidence High

Skillstore usage 13

Updated

2026-09-09

Skillstore Score

Why this score Evidence Confidence: High

Architecture

Maintainability

Content

Community

Spec Compliance

What You Can Build

Upgrade a Frontend Framework

Plan a React or routing upgrade with compatibility checks, staged package changes, tests, and rollback notes.

Patch Vulnerable Dependencies

Turn audit findings into a prioritized update plan with validation steps and peer dependency review.

Standardize Update Automation

Prepare Renovate or Dependabot policies that separate routine updates from major version review.

Try These Prompts

Create an Upgrade Inventory

Use this skill to review my dependency list. Identify outdated major versions, risky packages, and a staged first plan.

Plan a Framework Migration

Use this skill to plan an upgrade from my current framework version to the target version. Include compatibility risks and test gates.

Design Validation Coverage

Use this skill to create validation coverage for a dependency upgrade. Include unit, integration, visual, build, and rollback checks.

Coordinate Automated Updates

Use this skill to design a dependency automation policy. Separate patch, minor, and major updates, and define review rules.

Best Practices

Create a branch and capture a passing test baseline before any upgrade.
Upgrade one major dependency at a time and review changelogs before each step.
Run unit, integration, build, and regression checks after each meaningful change.

Avoid

Upgrading every package in one pass without a rollback plan.
Using force install flags to bypass peer dependency warnings without analysis.
Running codemods or migration scripts without reviewing the diff.

Frequently Asked Questions

Does this skill run upgrades automatically?

No. It provides workflow guidance and example commands that need user approval.

Which ecosystems does it cover best?

It mainly covers JavaScript, npm, yarn, React, testing libraries, Renovate, and Dependabot.

Can it replace changelog review?

No. It encourages changelog and migration guide review before version changes.

Does it include working scripts?

The reviewed package contains SKILL.md examples only; referenced resources are not present in the file tree.

How should I handle major versions?

Upgrade one major version at a time, run tests, and document fixes before continuing.

Is it useful for security updates?

Yes. It can help plan vulnerable dependency updates, but security fixes still need validation.

Developer Details

Author

wshobson

License

MIT

Skillstore revision

Version notice

The author did not declare a version.

Repository

https://github.com/wshobson/agents/tree/main/plugins/framework-migration/skills/dependency-upgrade

Ref

36e07d5e13068e5be64447e8f20b427cf2cbd21a

Maintenance freshness

7/21/2026

Usage

9 downloads · 226 views

File structure

📄 SKILL.md