Skills

I was always cautious with my dependencies, so on each update I reviewed the changes - supply chain attack, sudden bugs, or license changes were a thing way before LLMs. Now we can automate that using LLMs for good. Behold the skill I use. Most useful for .NET repos, you can use this as an idea for other stacks. The idea When updating packages: if it’s MS, I have no easy way to verify what code is changes, but I consider it’s safe to update. if it has known heavy breaking changes, I skip it and track in a separate task. I try to check the code. Almost every package has Github link, so I go there and see what’s new in commits for this release, I try to check to see there’s nothing malicious or if it contains something I can start using for this project. I try to check their website to see if the org or a person are still the same and not hacked. I update packages from the same source together. I.e. all Microsoft.Extensions.* or Dapper - they usually share a version and updating them separately causes linking errors. So, I made a skill that a model like Sonnet can run. It tries to do the update, run the tests and presents me a nicely formatted report. ...