upgrade-pack-generator — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited upgrade-pack-generator (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Generate upgrade-pack folders for dependency families in two stages:
The generator is monorepo-aware. During enrichment it must lock an explicit owner surface for the family:
The generated pack is docs/research only. Do not implement package changes while generating the pack.
python3 scripts/detect_repo_context.py --repo-root /path/to/repo --json python3 scripts/bootstrap_manifest.py \
--repo-root /path/to/repo \
--anchor-package lucide-react \
--out /tmp/upgrade-pack.yaml python3 scripts/enrich_manifest.py --manifest /tmp/upgrade-pack.yaml$repo-modernizer$opensrc$technical-writing$hard-cut python3 scripts/validate_upgrade_pack.py /tmp/upgrade-pack.yaml python3 scripts/research_upgrade_pack.py --manifest /tmp/upgrade-pack.yamlweb.run confirmation pass for required official docs andAPI-reference pages from research-bundle.json and record the results in web-research-findings.json.
pages:
python3 scripts/research_upgrade_pack.py --manifest /tmp/upgrade-pack.yaml python3 scripts/qualify_upgrade_pack.py --manifest /tmp/upgrade-pack.yaml python3 scripts/render_upgrade_pack.py \
--manifest /tmp/upgrade-pack.yaml \
--output-dir /path/to/repo/.agents/plans/upgrade/<topic>Every generated repo-local pack must contain exactly:
upgrade-pack.yamlresearch-snapshot.jsonresearch-bundle.jsonweb-research-findings.jsonqualification-snapshot.json<basename>-playbook.md<basename>-trigger-prompt.md<basename>-operator-mode.mdThe manifest is the canonical source. The markdown files are rendered outputs. research-snapshot.json and qualification-snapshot.json are the canonical machine-readable evidence files for the separate research and qualify stages. research-bundle.json is the raw evidence ledger that backs the research snapshot. web-research-findings.json is the machine-readable record of web.run confirmation for the required official pages.
Rendered file roles:
<basename>-playbook.mdimplementation run
<basename>-operator-mode.md<basename>-trigger-prompt.mdDo not hand-maintain operator-mode.md or trigger-prompt.md; regenerate them from the manifest.
Read references/manifest-schema.md before editing any override.
Family overrides live in references/family-overrides/. Use them when a dependency family recurs across repos and benefits from package-specific:
Current built-in family lanes:
lucide-reactnextjsexpo-easconvexturboreposhadcn-radix-uiKeep overrides narrow. Put only family-specific information there. Let the base generator provide the common structure.
Detect the target repo command family in this order:
package.json#packageManagerThe generator should write that decision into upgrade-pack.yaml and render package-manager-aware command variables into the pack. Do not force Bun into a pnpm/npm/Yarn repo.
Use the default research lanes in references/research-lanes.md.
Conditional routing:
$bun-dev only when Bun posture is actually relevant$imagegen unless raster asset generation is truly partof the package-family surface
scripts/detect_repo_context.pymanifests
scripts/bootstrap_manifest.pyupgrade-pack.yaml from generic defaults plus an optionalfamily override
scripts/enrich_manifest.pyupgrade-pack.yaml with family-specific repo probes, currentpackage versions, and live official-doc snapshots
scripts/validate_upgrade_pack.pyscripts/research_upgrade_pack.pyrepo-usage mapping, package identity, target-version reasoning, source-map drift checks, provenance scores, and the web.run queue into research-snapshot.json plus research-bundle.json
scripts/sync_source_map.pyreferences/source-maps/
scripts/qualify_upgrade_pack.pyqualification-snapshot.json
scripts/render_upgrade_pack.pysnapshot
Bootstrap a known family override:
python3 scripts/bootstrap_manifest.py \
--repo-root /path/to/repo \
--anchor-package lucide-react \
--out /tmp/lucide-upgrade-pack.yamlRender a generic pack for a package without an override:
python3 scripts/bootstrap_manifest.py \
--repo-root /path/to/repo \
--anchor-package commander \
--out /tmp/commander-upgrade-pack.yaml
python3 scripts/enrich_manifest.py \
--manifest /tmp/commander-upgrade-pack.yaml
python3 scripts/research_upgrade_pack.py \
--manifest /tmp/commander-upgrade-pack.yaml
python3 scripts/qualify_upgrade_pack.py \
--manifest /tmp/commander-upgrade-pack.yaml
python3 scripts/render_upgrade_pack.py \
--manifest /tmp/commander-upgrade-pack.yaml \
--output-dir /path/to/repo/.agents/plans/upgrade/commanderRefresh an existing repo-local pack after refining the manifest:
python3 scripts/enrich_manifest.py \
--manifest /path/to/repo/.agents/plans/upgrade/lucide-react/upgrade-pack.yaml
python3 scripts/validate_upgrade_pack.py \
/path/to/repo/.agents/plans/upgrade/lucide-react/upgrade-pack.yaml
python3 scripts/research_upgrade_pack.py \
--manifest /path/to/repo/.agents/plans/upgrade/lucide-react/upgrade-pack.yaml
python3 scripts/qualify_upgrade_pack.py \
--manifest /path/to/repo/.agents/plans/upgrade/lucide-react/upgrade-pack.yaml
python3 scripts/render_upgrade_pack.py \
--manifest /path/to/repo/.agents/plans/upgrade/lucide-react/upgrade-pack.yaml \
--output-dir /path/to/repo/.agents/plans/upgrade/lucide-react~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.