Agent skill · software engineering · secondsky
dependency-upgrade
Secure dependency upgrades with supply chain protection, cooldowns, and staged rollout. Use when upgrading deps, configuring security policies, or preventing supply chain attacks.
Why this skill is useful
Adds specific configuration scripts for multiple package managers to enhance dependency security and management that the AI wouldn't reliably generate on its own.
What it needs
Requires bun, deno, npm, pnpm, yarn installed locally. About 10k tokens when loaded. Last updated 2026-08-06. 204 stars on the source repository.
What this skill does
Dependency Upgrade Manage dependency upgrades with supply chain security, compatibility analysis, staged rollout, and comprehensive testing across all major package managers. When to Use This Skill Upgrading major framework or library versions Configuring supply chain attack prevention (cooldown, script blocking, lockfile hardening) Setting up secure package manager configuration Resolving dependency conflicts or peer dependency issues Planning incremental upgrade paths with testing Automating dependency updates with Renovate, Dependabot, or Snyk Auditing dependencies for vulnerabilities Setting up CI/CD dependency security workflows Two Modes of Operation Interactive — Walk through setup questions to generate tailored config. Use for fresh setup. Default — Apply recommended defaults immediately: 7-day cooldown, block all scripts, frozen-lockfile, lockfile-lint, Dependabot with cooldown. Customization optional. Interactive Setup Flow When the user wants tailored configuration, walk through these decisions. Skip this section entirely if using default mode. Tier 1: Required Decisions Always ask these 3 questions before generating any config: 1. Package Manager "Which package manager does this project use?" Answer Generates -------- ----------- npm .npmrc Bun bunfig.toml pnpm pnpm-workspace.yaml Yarn .yarnrc.yml Deno deno.json config 2. Cooldown Period "How many days should newly published packages age before install? This prevents supply chain attacks where malicious packages are discovered and unpublished within days." Option Days Use Case -------- ------ ---------- Aggressive 3 Catches most typosquatting Recommended 7 Good balance for most projects Conservative 14 Critical/production systems Paranoid 21 Matches Snyk's built-in default Custom N User specifies 3. …
How to use it
Reference it in AdaL, Claude Code, Cursor or any coding agent — nothing to install:
@skills secondsky/dependency-upgrade