CtrlK
BlogDocsLog inGet started
Tessl Logo
SkillPublic

dependency-upgrade

Master major dependency version upgrades, compatibility analysis, staged upgrade strategies, and comprehensive testing approaches.

Quality

60%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide
SecuritybySnyk

Passed

No findings from the security scan

Fix and improve this skill with Tessl

tessl review fix ./plugins/AI-Agents-Safe-Coding-Skills-claude/skills/dependency-upgrade/SKILL.md

The canonical home for this skill is dependency-upgrade in administrakt0r/AI-Agents-Safe-Coding-Skills

SKILL.md
Quality
Evals
Security

Quality

Content

45%Weight 40%Scale 1-5

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

The body delivers a genuinely useful staged upgrade methodology with concrete npm/yarn commands, per-step test checkpoints, and a rollback plan. However, it is padded with concepts Claude already knows, contains fabricated or non-executable tool examples, and its progressive disclosure is broken: it cites seven-plus bundle files that do not exist while inlining all of that content anyway.

Suggestions

Fix progressive disclosure first: either create the advertised `references/`, `assets/`, and `scripts/` files and move the inline semver guide, compatibility matrix, testing strategy, and checklist into them, or delete the Resources section and the `resources/implementation-playbook.md` pointer — also reconciling the inconsistent `resources/` vs `references/` path prefix.

Remove or verify fabricated commands: replace `npx react-codeshift` with the real React codemod workflow, drop or correct `npx changelog-parser`, strip `//` comments from the renovate JSON, and implement or delete the `checkCompatibility` stub.

Cut token spend on known concepts: delete the Semantic Versioning Review section (or compress it to the ^/~ cheat line), and trim the generic Best Practices/Common Pitfalls lists to only non-obvious advice like lock-file and peer-dependency gotchas.

DimensionReasoningScore

Conciseness

The body spends significant tokens re-teaching what Claude already knows: a "Semantic Versioning Review" explaining MAJOR.MINOR.PATCH and ^/~ semantics, generic "Best Practices" and "Common Pitfalls" lists, and repeated bare `npm run test` blocks. Multiple padded sections match the "noticeably verbose; several unnecessary explanations" anchor; it is not a 3 because the padding spans many sections rather than being minor.

2 / 5

Actionability

Much of the guidance is executable (`npm outdated`, `npx npm-check-updates -u`, Dependabot YAML, rollback script), but there are real gaps and fabrications: `checkCompatibility()` is an empty stub, the renovate config contains `//` comments making it invalid JSON, `npx changelog-parser react 16.0.0 17.0.0` and `npx react-codeshift` are non-existent tools/usages, and `rollback.sh` is fenced as JavaScript. This fits the anchor for concrete guidance that is incomplete with pseudocode elements rather than the mostly-executable anchor of 4.

3 / 5

Workflow Clarity

The Staged Upgrade Strategy gives a clear sequence — Planning (identify versions, read changelogs) → Incremental Updates with an explicit "Test" checkpoint after each upgrade → Validation — plus a rollback script with a failure branch and a pre/during/post checklist. It misses a 5 because the workflow is fragmented across topic sections instead of one coherent flow, and the Phase 3 peer-dependency test is only an empty comment.

4 / 5

Progressive Disclosure

The Resources section lists `references/semver.md`, `assets/upgrade-checklist.md`, `scripts/audit-dependencies.sh`, and four other bundle files, but none of these files (nor the `resources/implementation-playbook.md` cited in Instructions) exist on disk — every reference is dangling. Meanwhile the material those files would hold (semver guide, compatibility matrix, testing strategy, upgrade checklist) is duplicated inline in a ~425-line body, matching the anchor for content that clearly belongs in separate files being inlined with broken navigation.

2 / 5

Total

11

/

20

Passed

Description

58%Weight 40%Scale 1-5

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

The description communicates a clear domain and several capability areas, but it reads as a topic list rather than a trigger-oriented description. It lacks any "use when" guidance and omits the natural vocabulary (packages, npm, breaking changes, outdated) that would let a user's request reliably surface it.

Suggestions

Append an explicit trigger clause, e.g. "Use when the user mentions upgrading dependencies, outdated or vulnerable packages, breaking changes, or version conflicts in npm/yarn projects."

Replace abstract phrasing like "comprehensive testing approaches" with concrete actions such as "run compatibility checks, apply codemods, and validate upgrades with test suites".

Add natural keywords and ecosystem terms users actually say: "update packages", "npm audit", "peer dependency conflicts", "package.json".

DimensionReasoningScore

Specificity

The description lists several capability areas — "major dependency version upgrades, compatibility analysis, staged upgrade strategies" — matching the anchor for several specific actions with minor gaps. It falls short of a 5 because "comprehensive testing approaches" is abstract and the coverage is not comprehensive; it exceeds a 3 because more than 1-2 concrete actions are named.

4 / 5

Completeness

The description clearly answers "what" but contains no "Use when..." clause or equivalent trigger guidance, which per the judging guidelines caps completeness at 3. The "what" is explicit, so it is above the vague-what anchor of 2.

3 / 5

Trigger Term Quality

Terms like "dependency", "version upgrades", and "compatibility" are relevant, but common natural phrases users would say are missing: "update packages", "breaking changes", "outdated dependencies", "npm", or "package.json". This matches the anchor for some relevant keywords but missing common variations or synonyms.

3 / 5

Distinctiveness Conflict Risk

"Major dependency version upgrades" carves a clear niche with low conflict risk against unrelated skills. Minor overlap remains with general package-management or CI/automation skills, matching the "mostly distinct; minor overlap risk" anchor rather than the 5's minimal-conflict bar.

4 / 5

Total

14

/

20

Passed

Validation

87%

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 14 / 16 Passed

Validation for skill structure

CriteriaDescriptionResult

frontmatter_unknown_keys

Unknown frontmatter key(s) found; consider removing or moving to metadata

Warning

referenced_paths_exist

Referenced path issues: 7 missing

Warning

Total

14

/

16

Passed

Repository

administrakt0r/AI-Agents-Safe-Coding-Skills

Path

plugins/AI-Agents-Safe-Coding-Skills-claude/skills/dependency-upgrade/SKILL.md

Reviewed

Table of Contents

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.