I was always cautious with my dependencies, so on each update I reviewed the changes - supply chain attack, sudden bugs, or license changes were a thing way before LLMs. Now we can automate that using LLMs for good. Behold the skill I use.

Most useful for .NET repos, you can use this as an idea for other stacks.

The idea

When updating packages:

  • if it’s MS, I have no easy way to verify what code is changes, but I consider it’s safe to update.
  • if it has known heavy breaking changes, I skip it and track in a separate task.
  • I try to check the code. Almost every package has Github link, so I go there and see what’s new in commits for this release, I try to check to see there’s nothing malicious or if it contains something I can start using for this project.
  • I try to check their website to see if the org or a person are still the same and not hacked.
  • I update packages from the same source together. I.e. all Microsoft.Extensions.* or Dapper - they usually share a version and updating them separately causes linking errors.

So, I made a skill that a model like Sonnet can run. It tries to do the update, run the tests and presents me a nicely formatted report.

Ok, I want that too

This is not plug and play thing like the collections “100 must have skills” out there. Each skill in your set has to be justified and fine-tuned.

Prerequisites:

  • completed security check for the files. I know my stuff is good, but such checks must be as unconditional habit.

To use, ask your agent to:

  1. install the skill by downloading all files from update-nuget-packages into your skills folder
  2. follow the porting guide in file PORTING.md. It will check what’s missing and guide you through adjustments.