dependency-upgrade

Secure dependency upgrades with supply chain protection, cooldowns, and staged rollout. Use when upgrading deps, configuring security policies, or preventing supply chain attacks.

Quality

73%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

Securityby

Passed

No findings from the security scan

Fix and improve this skill with Tessl

tessl review fix ./plugins/dependency-upgrade/skills/dependency-upgrade/SKILL.md

Quality

Content

71%Weight 40%Scale 1-5

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

The body is highly actionable with executable configs and a clear staged-upgrade workflow including validation and rollback. Its main weaknesses are length and redundancy between the interactive setup and detail sections, and broken references to a non-existent templates/ directory and a corrupted script.

Suggestions

Remove the redundancy between the Interactive Setup Flow tables and the later Cooldown / Post-Install / Automated-Updates sections by having the interactive flow point to the detail sections instead of restating the options.

Create the referenced templates/ directory with the 8 listed template files, or remove the Template Files table and the inline `templates/...` references to eliminate dead navigation paths.

Fix or remove scripts/generate-dependency-upgrades.sh, which currently contains only '404: Not Found'.

Dimension	Reasoning	Score
Conciseness	Mostly actionable and information-dense, but at ~584 lines there is notable redundancy: the Interactive Setup Flow (Tier 1-3) tables and the later Cooldown / Post-Install / Automated-Updates sections restate the same options, plus some explanatory prose Claude already knows.	3 / 5
Actionability	Fully executable, copy-paste-ready config snippets and commands across npm, Bun, pnpm, Yarn, and Deno, with tables mapping each answer to the concrete file it generates.	5 / 5
Workflow Clarity	Clear numbered staged-upgrade workflow with a 'Test immediately' checkpoint, a rollback plan with if/else error recovery, and a comprehensive pre/during/post checklist; baseline and post-upgrade scans are marked optional rather than enforced, a minor validation gap.	4 / 5
Progressive Disclosure	Reference files are well-organized with a dedicated 'When to Load References' table and one-level-deep pointers, but the skill extensively references a templates/ directory (8 templates) and a script that do not exist or are broken, creating dead navigation paths.	3 / 5
	Total	15 / 20 Passed

Description

75%Weight 40%Scale 1-5

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

The description is concise, third-person, and explicitly covers both what the skill does and when to use it with concrete trigger phrases. It is strong overall but could add more natural tooling keywords and tighten the broad 'configuring security policies' trigger.

Dimension	Reasoning	Score
Specificity	Names the domain and several concrete capabilities ('supply chain protection, cooldowns, and staged rollout'), but omits other covered actions like testing and lockfile hardening, leaving minor gaps.	4 / 5
Completeness	Explicitly answers both what ('Secure dependency upgrades with supply chain protection, cooldowns, and staged rollout') and when ('Use when upgrading deps, configuring security policies, or preventing supply chain attacks'), though the 'when' triggers are slightly broad.	4 / 5
Trigger Term Quality	Includes natural terms users say ('upgrading deps', 'preventing supply chain attacks') but misses common tooling keywords like npm, Renovate, Dependabot, and lockfile.	4 / 5
Distinctiveness Conflict Risk	Mostly a distinct niche (dependency upgrades with a supply-chain focus); 'configuring security policies' is broad enough to risk minor overlap with general security skills.	4 / 5
	Total	16 / 20 Passed

Validation

93%

Warnings & errors only

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 15 / 16 Passed

Validation for skill structure

Criteria	Description	Result
skill_md_line_count	SKILL.md is long (584 lines); consider splitting into references/ and linking	Warning

	Total	15 / 16 Passed

Repository: secondsky/claude-skills
Path: plugins/dependency-upgrade/skills/dependency-upgrade/SKILL.md
Commit: 84802a4

Reviewed: 6 days ago

Table of Contents

Discovery Implementation Validation

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.