Loading skill
Install any skill in seconds. Free to start, no credit card required.
Get Started Free →backnotprop/update-deps
Audit and update npm/Bun dependencies with supply chain integrity checks — verifies maintainers, publish age, tarball diffs, and provenance before bumping. Defers risky packages to ~/.supply-chain/notes/.
Passed 11 of 17 test cases with the skill, and 9 of 17 without it.
and 2 more in the full report
5 fixed9 passed either way6 still failing2 broke
Tokens, turns and time describe resource use, not a dollar price.
One of 3 test cases the skill fixed. Same model, same prompt, with and without the skill.
We verified that packages `[email protected]` and `[email protected]` are completely safe to bump. What Bun command applies these explicit version upgrades?
| Checked | Without skill | With skill |
|---|---|---|
| Executes bun update [email protected] [email protected] | Missed | Passed |
The instructions your model reads when the skill loads.
Audit outdated packages, verify supply chain integrity, bump what's safe, defer what needs review, and log everything.
This process has three phases: discovery, integrity audit, and execution. The integrity audit is the most important — every package gets checked before it touches the lockfile.
Run bun outdated to get the full list of packages with available updates.
bun outdated
Parse the output into a structured list. For each package, note:
* in the output — the footnote "The * indicates that version isn't true latest due to minimum release age" confirms this)Also check whether any packages are blocked entirely by the age gate (like @pierre/diffs was when its minimum semver range couldn't resolve). Flag these separately — they may need minimumReleaseAgeExcludes in bunfig.toml.
This is the core of the process. Spawn one Sonnet sub-agent per package to run the integrity check in parallel. Sonnet is used here because these are independent, structured verification tasks that don't need heavier reasoning.
Each sub-agent receives the package name, current version, and target version, and performs the following checks:
For each outdated package, spawn a Sonnet agent with this task:
You are auditing the npm package "{package}" for a version bump from {current} to {target}.
Run these checks and report back with a JSON object:
1. **Maintainer verification**: Check if maintainers changed between versions.
npm view {package}@{current} maintainers --json
test cases passed, vs 9 / 17 without
More skills from the same source and nearby in the registry, with their headline benchmark lift.