dep-upgrade

dep-upgrade is a Secrets & supply chain skill for AI agents, published by takoeight0821 in the malgo repository on GitHub. Skillspace rates dep-upgrade D (57/100) and it passed the safety scan; the rating is based on static analysis only.

Detect outdated dependencies, upgrade them safely, verify the build, and create a PR. Covers Haskell (cabal/package.yaml/freeze file), GitHub Actions (pinned SHA versions), mise toolchain versions, and Nix flake inputs. Includes security advisory checks, release maturity verification (avoid bleeding-edge releases), supply chain attack detection, and unnecessary dependency removal. This skill enforces explicit user-approval gates before modifying files and before creating PRs — these gates are mandatory even under Auto Mode. Use this skill whenever the user mentions upgrading, updating, or bumping dependencies, packages, actions, toolchains, or flake inputs — even if they say something casual like "update deps" or "are my packages outdated?". Also trigger when the user asks about Dependabot-like workflows, version pinning, freeze file maintenance, dependency auditing, security scanning, or trimming unused packages.

Grade

D

Quality

57 / 100

Safety

Passed

GitHub stars

45

Unproven: rated by static analysis only, not yet compared head-to-head.

Our two independent classifiers differ on this skill's category, so treat the placement as provisional.

This rating describes the version of the repository we crawled; it may have changed since, so go by its current files.

Skillspace indexes and rates this skill; it does not host or endorse it. Run third-party skills at your own risk.