1k-pkg-upgrade-review
Analyzes and reports on risks associated with package upgrades.
Install
mkdir -p .claude/skills/1k-pkg-upgrade-review && curl -L -o skill.zip "https://agentskills.codes/api/skills/download/5287" && unzip -o skill.zip -d .claude/skills/1k-pkg-upgrade-review && rm skill.zipInstalls to .claude/skills/1k-pkg-upgrade-review
Activation
This is the description your AI agent reads to decide when to run this skill — the better it matches your request, the more reliably it fires.
Reviews package version upgrades — diffs source between versions, traces call sites, and generates compatibility reports.Key capabilities
- →Identify package name and version range for upgrades
- →Download and extract package versions from npm registry
- →Diff source code between package versions
- →Classify changes in API signature, return value, and behavior
- →Search project source code for direct package usage
- →Trace call sites to verify argument usage and compatibility
How it works
It identifies package versions, downloads and extracts them, then performs a source-level diff and traces call sites to classify changes and assess compatibility risks.
Inputs & outputs
When to use 1k-pkg-upgrade-review
- →Reviewing dependency updates
- →Auditing breaking changes
- →Generating compatibility reports
About this skill
Package Upgrade Review
Evaluates npm/yarn package version upgrades by performing source-level diff analysis, tracing all call sites, and producing a structured compatibility report.
Output language: Chinese (matching team conventions).
Quick Reference
| Topic | Guide | Description |
|---|---|---|
| Review workflow | review-workflow.md | Step-by-step review process |
| Report template | report-template.md | Output format and risk guidelines |
| Example report | example-report.md | Real case: @isaacs/brace-expansion 5.0.0 -> 5.0.1 |
When to Use
- Dependabot / Renovate PRs that bump dependency versions
- Manual
yarn upgradeornpm updatechanges - Any PR that modifies
yarn.lockorpackage-lock.json - When team needs to understand what actually changed inside a package before merging
Workflow Overview
- Identify the package name and version range (old -> new)
- Download both versions from npm registry and extract
- Diff source code between versions (focus on JS/TS, not metadata)
- Classify changes: API signature, return value, new exports, removed exports, behavior changes
- Search project source code for direct imports/usage
- Search
node_modulesfor indirect usage via intermediate packages - Trace each call site to verify argument usage and compatibility
- Assess compatibility risks: signature, return type, return content, side effects
- Generate structured report to
node_modules/.cache/pkg-upgrade/ - Post the full report as a PR comment via
gh pr comment
Key Commands
# Download and extract both versions for diffing
mkdir -p /tmp/pkg-diff && cd /tmp/pkg-diff
curl -sL $(npm view PKG@OLD_VER dist.tarball) | tar xz -C old
curl -sL $(npm view PKG@NEW_VER dist.tarball) | tar xz -C new
# Compare file lists
diff -rq old/package new/package
# Diff main source
diff old/package/dist/commonjs/index.js new/package/dist/commonjs/index.js
# Search project code for direct usage
grep -r "PACKAGE_NAME" --include="*.ts" --include="*.tsx" --include="*.js" -l . \
--exclude-dir=.git --exclude-dir=node_modules
# Search node_modules for indirect usage
grep -rn "from ['\"]PACKAGE_NAME['\"]" node_modules/ --include="*.js" --include="*.mjs" \
| grep -v "node_modules/.cache"
# Check package metadata
npm view PKG@NEW_VER deprecated
npm view PKG@NEW_VER dist.integrity
Report Output
- Local file:
node_modules/.cache/pkg-upgrade/<package-name>-<old>-to-<new>.md - PR comment: The full report MUST also be posted as a comment on the PR via
gh pr comment
Related Skills
/1k-code-review-pr- Comprehensive PR code review (security, code quality, platform patterns)
Limitations
- →Output language is Chinese
- →Report is generated to node_modules/.cache/pkg-upgrade/
- →Report must be posted as a PR comment via gh pr comment
How it compares
This skill automates source-level diffing and call site tracing for package upgrades, generating a structured report in Chinese, unlike manual review.
Compared to similar skills
1k-pkg-upgrade-review side by side with the closest alternatives in the catalog.
| Skill | Installs | Updated | Safety | Difficulty |
|---|---|---|---|---|
| 1k-pkg-upgrade-review (this skill) | 1 | 1mo | Review | Intermediate |
| github-code-review | 13 | 2mo | Review | Advanced |
| reviewing-code | 21 | 8mo | No flags | Intermediate |
| reviewing-nextjs-16-patterns | 11 | 8mo | Review | Intermediate |
Try saying
Example prompts that trigger this skill in your AI assistant.
More by OneKeyHQ
View all by OneKeyHQ →You might also like
github-code-review
ruvnet
Comprehensive GitHub code review with AI-powered swarm coordination
reviewing-code
CaptainCrouton89
Systematically evaluate code changes for security, correctness, performance, and spec alignment. Use when reviewing PRs, assessing code quality, or verifying implementation against requirements.
reviewing-nextjs-16-patterns
djankies
Review code for Next.js 16 compliance - security patterns, caching, breaking changes. Use when reviewing Next.js code, preparing for migration, or auditing for violations.
cookbook-audit
anthropics
Audit an Anthropic Cookbook notebook based on a rubric. Use whenever a notebook review or audit is requested.
pr-review
pytorch
Review PyTorch pull requests for code quality, test coverage, security, and backward compatibility. Use when reviewing PRs, when asked to review code changes, or when the user mentions "review PR", "code review", or "check this PR".
find-bugs
davila7
Find bugs, security vulnerabilities, and code quality issues in local branch changes. Use when asked to review changes, find bugs, security review, or audit code on the current branch.