CtrlK
BlogDocsLog inGet started
Tessl Logo

dependency-upgrade

Plan, batch, and verify dependency upgrades safely. Triages outdated packages into risk tiers, upgrades in order (dev/minor/patch first, runtime majors last), verifies each batch before moving on, and produces an auditable commit sequence. Use when asked to "upgrade deps", "bump packages", "update node_modules", "fix vulnerabilities", "upgrade React/Node/TypeScript", or after `/gsd start dep-upgrade`. Complements the dep-upgrade workflow template with execution-level rigor.

77

Quality

96%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

SecuritybySnyk

Passed

No findings from the security scan

SKILL.md
Quality
Evals
Security

Quality

Content

92%

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

Highly actionable, lean operational guidance with a clearly sequenced workflow and strong validation/feedback loops. The only gap is progressive disclosure: the skill is a single long file with no reference files, where templates and ecosystem command tables could be split out one level deep.

Suggestions

Extract the commit-message and summary-report templates into references/templates.md and link to them from the process steps to add one-level-deep progressive disclosure and trim inline bulk.

Move the per-ecosystem outdated/audit command lists (npm/pnpm/yarn/pip/uv/cargo/bundle/go) into a references/ecosystem-commands.md table, keeping SKILL.md as the process overview.

Consolidate the overlap between <core_principle> and <anti_patterns> (e.g., 'npm update blindly', 'multiple majors in one commit', 'no verification between batches') into a single 'what not to do' section to reduce redundancy.

DimensionReasoningScore

Conciseness

The body is command- and template-heavy with minimal concept-explanation, assuming Claude's competence; the only near-redundancy is anti_patterns restating some core_principle rules, but those one-liners earn their place and add the --legacy-peer-deps/--force warnings not covered elsewhere. Not level 2, which requires unnecessary explanation or noticeable slack.

3 / 3

Actionability

Provides copy-paste-ready commands across ecosystems ('npm outdated', 'uv pip list --outdated', 'cargo outdated', 'go list -m -u all', 'npm install package@version', 'cargo update -p', 'lsp diagnostics') plus a concrete commit-message template and a filled-in summary template. Matches the fully-executable anchor; not level 2, which calls for pseudocode or missing details.

3 / 3

Workflow Clarity

Six clearly sequenced steps with explicit validation checkpoints (Step 4: build, test, lint, smoke-test) and an error-recovery feedback loop ('If any step fails... If the failure is trivial, fix it in the same commit... If non-trivial... split') plus a success_criteria checklist — appropriate rigor for a batch operation. Not level 2, which has only implicit checkpoints.

3 / 3

Progressive Disclosure

Well-organized into tagged sections (objective/context/core_principle/process/anti_patterns/success_criteria), but the skill is a single monolithic SKILL.md over 50 lines with no bundle references, so the small-skill exception does not apply and content that could be split (commit template, summary template, per-ecosystem command lists) is inline. Not level 1 (it is well-structured, not a wall of text); not level 3 because there are no well-signaled one-level-deep references or content split.

2 / 3

Total

11

/

12

Passed

Description

100%

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

A strong, specific description that concretely states what the skill does and when to use it with a rich set of natural trigger terms. It is clearly distinct from other skills and uses correct third-person voice throughout.

DimensionReasoningScore

Specificity

Lists multiple concrete actions — 'Triages outdated packages into risk tiers', 'upgrades in order', 'verifies each batch before moving on', and 'produces an auditable commit sequence' — matching the anchor for multiple specific concrete actions; not level 2, which requires incomplete action coverage.

3 / 3

Completeness

Explicitly answers 'what' (plan, batch, verify, risk-tier, auditable commit sequence) and 'when' via a 'Use when asked to ...' clause with multiple triggers; voice is third person ('Triages', 'upgrades', 'verifies'), so no person-voice penalty applies.

3 / 3

Trigger Term Quality

Covers natural user phrasings — 'upgrade deps', 'bump packages', 'update node_modules', 'fix vulnerabilities', 'upgrade React/Node/TypeScript' — giving good coverage of terms users would actually say; not level 2, which expects missing common variations.

3 / 3

Distinctiveness Conflict Risk

Occupies a clear niche (dependency upgrades) with distinct, dep-specific triggers that are unlikely to fire for unrelated skills; the broad 'fix vulnerabilities' phrase is the only minor overlap risk, but the framing keeps it unambiguous.

3 / 3

Total

12

/

12

Passed

Validation

100%

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation16 / 16 Passed

Validation for skill structure

No warnings or errors.

Repository
gsd-build/gsd-2
Reviewed

Table of Contents

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.