New: 98,000+ skills indexed from GitHub repos with 100+ stars · every skill safety-checkedBrowse top skillsTop skills
Esc to closeBrowse all skills
Submit a skillBrowse skills
Submit a skillBrowse skills

Agent skill

Dependency Pins

by cognitivegears in cognitivegears/ha-escpos-thermal-printer

A skill your agent uses when bumping any dependency, upgrading the HA test harness (pytest-homeassistant-custom-component) or HA floor, or handling Dependabot PRs/security alerts — per-package pin…

MITAuto-check passedTesting & QA

Install Dependency Pins

skills CLI
$ npx skills add cognitivegears/ha-escpos-thermal-printer --skill dependency-pins -a claude-code

Project install by default; add -g for ~/.claude/skills/.

GitHub CLI
$ gh skill install cognitivegears/ha-escpos-thermal-printer dependency-pins --agent claude-code

Project scope by default; add --scope user for a personal install. Needs GitHub CLI 2.90.0 or later (public preview).

Manual copy
$ git clone --depth 1 https://github.com/cognitivegears/ha-escpos-thermal-printer.git skills-src && mkdir -p .claude/skills && cp -r skills-src/.claude/skills/dependency-pins .claude/skills/dependency-pins && rm -rf skills-src

Use ~/.claude/skills/ instead of .claude/skills for a personal install. The folder must contain SKILL.md.

Claude Code skills documentation · loads skills from .claude/skills/

Facts

Skill name
dependency-pins
GitHub stars
112
Token cost
~1.1k tokens
SKILL.md length
509 words
Files
1
Skills in repo
1
Repo updated
First seen
Licence
MIT

At a glance

A skill your agent uses when bumping any dependency, upgrading the HA test harness (pytest-homeassistant-custom-component) or HA floor, or handling Dependabot PRs/security alerts — per-package pin…

  • Bumping any dependency
  • Calls uv
  • Upgrading the HA test harness (pytest-homeassistant-custom-component)
  • Handling Dependabot PRs/security alerts — per-package pin rationale for pytest

What it does

Dependency Pins is an agent skill from cognitivegears/ha-escpos-thermal-printer. Use when bumping any dependency, upgrading the HA test harness (pytest-homeassistant-custom-component) or HA floor, or handling Dependabot PRs/security alerts — per-package pin rationale for pytest, mypy, dbus-fast, Pillow, respx, and serialx, all of which are constrained by Home Assistant or the test harness.

Its SKILL.md is about 1.1k tokens, which your agent loads only when the skill is triggered. It is a single SKILL.md file with no bundled scripts.

It sits in Testing & QA, covering Unit testing, Dependency management and Type safety. It works with Home Assistant, pytest and GitHub. The repository describes itself as: Home Assistant / HACS integration for network/usb/serial/bluetooth thermal printers. The licence is MIT.

When your agent uses it

  • Bumping any dependency
  • Upgrading the HA test harness (pytest-homeassistant-custom-component)
  • Handling Dependabot PRs/security alerts — per-package pin rationale for pytest
  • All of which are constrained by Home Assistant

Example prompts

  • “/dependency-pins”

What it can do on your machine

Read from SKILL.md and the folder at commit d2473ba. It shows what the files ask for, not the result of running them.

  • Tool permissions

    Pre-approves nothing: there is no allowed-tools line, so your agent's usual permission prompts apply.

    From allowed-tools in the SKILL.md frontmatter.

  • Runs code

    Shell commands in SKILL.md call:

    • uv

    From the folder's file list and the shell code blocks in SKILL.md.

  • Network

    No URLs in SKILL.md. Its commands use uv, which can reach the network depending on how they are called.

    From URLs in SKILL.md, links to its own repository left out.

  • Credentials

    Names no API keys, tokens, secrets or passwords.

    From names ending in _API_KEY, _TOKEN, _SECRET, _KEY or _PASSWORD in SKILL.md.

Context cost

Dependency Pins loads about 1.1k tokens when it runs. Until then it costs about 82 tokens; SKILL.md has 509 words of instructions outside code blocks.

Always · name and description, kept in context so the agent knows when to use it
~82
When it runs · the whole SKILL.md, loaded when a task matches
~1.1k

Estimates: characters ÷ 4, the usual rule of thumb; real counts depend on the model's tokenizer. Scripts and assets cost tokens only if the agent reads them.

Safety

Auto-check passed

The automated check found no risky patterns in SKILL.md.

Automated static check — not a guarantee. Review scripts before installing. It scans the text of SKILL.md for risky patterns (piping downloads into a shell, reading credential files, hidden Unicode, destructive commands); files beside SKILL.md are not scanned.

SKILL.md

The full file from cognitivegears/ha-escpos-thermal-printer at commit d2473ba, republished under its MIT licence (© cognitivegears). 509 words, ~1,088 tokens.

Download SKILL.mdSave it as .claude/skills/dependency-pins/SKILL.md (or your agent's skills folder).
name
dependency-pins
description
Use when bumping any dependency, upgrading the HA test harness (pytest-homeassistant-custom-component) or HA floor, or handling Dependabot PRs/security alerts — per-package pin rationale for pytest, mypy, dbus-fast, Pillow, respx, and serialx, all of which are constrained by Home Assistant or the test harness.

HA-constrained dependency pins

  • pytest is pinned by pytest-homeassistant-custom-component (currently pytest==9.0.3). Dependabot is configured to ignore standalone pytest bumps (see .github/dependabot.yml). When upgrading the HA test harness (pytest-homeassistant-custom-component), check whether the new version pins a different pytest and bump pytest in pyproject.toml to match. If upstream ever loosens the pin, remove the pytest ignore rule from dependabot.yml.
  • mypy is no longer capped — the harness's ast-serialize==0.3.0 hard pin (which blocked mypy 2.2+) was dropped in 0.13.348, so mypy resolves freely and Dependabot manages it again (the mypy ignore rule was removed from dependabot.yml). If a future harness release re-pins ast-serialize, re-add the ignore rule and cap mypy to the last version that resolves.
  • dbus-fast and Pillow are provided by HA core and deliberately absent from manifest.json (HACS default-store review nit: a custom-integration pin fights core's own constraints on upgrade). At HA runtime, Pillow arrives transitively via python-escpos under HA's constraint file, and bluez.py gracefully degrades when dbus-fast is absent. Both stay pinned in pyproject.toml for dev/CI only — match HA core's pins when upgrading the test harness. The exclusion is enforced by MANIFEST_EXCLUDES in scripts/sync_manifest_requirements.py and HA_PROVIDED in scripts/check_requirements_sync.py (keep the two sets mirrored). Dependabot is configured to ignore standalone pillow and dbus-fast bumps (see .github/dependabot.yml).
  • respx is pinned by pytest-homeassistant-custom-component (currently respx==0.23.1). Dependabot is configured to ignore standalone respx bumps (see .github/dependabot.yml). When upgrading the HA test harness, check whether the new version pins a different respx and bump it in pyproject.toml to match.
  • serialx is pinned by HA core (package_constraints.txt): ==1.7.0 (HA 2026.5.0), ==1.7.3 (HA 2026.5.4), ==1.8.0 (HA 2026.6.0), ==1.8.2 (HA 2026.7.4 – 2026.8.1), ==1.10.0 (HA 2026.9.3; 1.9–1.10 changed only kwarg pass-through and Win32 error types). HA installs manifest requirements with -c package_constraints.txt, so an exact pin in manifest.json is unsatisfiable on any HA version that carries a different pin. manifest.json carries >=1.7.0,<2; this is safe because the 1.7→1.8 change only touched the async write API and this integration uses the sync API throughout. pyproject.toml pins ==1.10.0 to match the HA version used by the CI test harness (pytest-homeassistant-custom-component==0.13.366 → HA 2026.9.3). Dependabot is configured to ignore standalone serialx bumps (see .github/dependabot.yml). When upgrading the HA test harness, check package_constraints.txt for the new HA version and bump the dev pin in pyproject.toml to match.
  • After HA version bumps, re-check Dependabot security alerts (https://github.com/cognitivegears/ha-escpos-thermal-printer/security/dependabot). Most open alerts are against the HA-pinned packages above — direct (pyproject.toml Pillow) or uv.lock transitives (aiohttp, pyOpenSSL, PyJWT, orjson, requests, uv, cryptography, etc.). They only affect dev/CI environments — end users install via manifest.json — and auto-clear when HA releases a version with patched pins. After a HA bump (i.e. once pytest-homeassistant-custom-component points to the new HA), run uv lock --upgrade and verify which alerts close.
  • The ignore: block in dependabot.yml only suppresses version updates — it does not suppress security updates (which trigger the Dependabot Updates worker independently and will fail noisily when the bump conflicts with an HA pin). For HA-pinned packages, dismiss the security alert as tolerable_risk with a note pointing at the HA pin; the alert will re-surface if a new advisory lands against the still-current pinned version.

© cognitivegears, MIT. Rendered from Markdown: HTML in the file is shown as text, images as links, and headings moved down two levels. Raw file

Files

Just SKILL.md in .claude/skills/dependency-pins of cognitivegears/ha-escpos-thermal-printer.

Open the folder on GitHubat commit d2473ba

Compare with similar skills

Dependency Pins next to the 5 skills that share the most tags, products or categories with it. Stars are the repository's; “used in” counts other GitHub owners with a copy.

Dependency Pins compared with similar skills
SkillStarsUsed inTokensAuto-checkLicenceRepo updated
Dependency Pins this skillcognitivegears/ha-escpos-thermal-printer112—~1.1kAutomated safety check: PassMIT
Kedro Babysitkedro-org/kedro11k—~4kAutomated safety check: PassCustom licence
Issue WriterNVIDIA/container-canary308—~1.1kAutomated safety check: PassApache-2.0
Ha Integration TestingFutureTense/keymaster349—~522Automated safety check: PassMIT
Checkav1155/houndarr292—~366Automated safety check: PassAGPL-3.0
Validatejuliepy/AI-Engineer-from-scrach436—~500Automated safety check: PassNone

Similar skills

  • Kedro Babysit

    kedro-org/kedro

    Run Kedro's local lint / format / type-check / tests on changed files (uses the project's pre-commit hooks, ruff, mypy, pytest, lint-imports, detect-secrets, Make targets — in the right venv), or…

    11k GitHub stars~4k tokensUpdated yesterday
    DevelopmentAuto-check passed

  • Issue Writer

    NVIDIA/container-canary

    Official

    Draft and revise concise, human-focused GitHub issues for pytest-kind-ng.

    308 GitHub stars~1.1k tokensUpdated 1 mo ago
    Testing & QAAuto-check passed

  • Ha Integration Testing

    FutureTense/keymaster

    Workflows, conventions, and commands for writing and running async Home Assistant unit and integration tests using pytest, tox, pytest-homeassistant-custom-component, and coverage tools.

    349 GitHub stars~522 tokensUpdated yesterday
    Testing & QAAuto-check passed

  • Check

    av1155/houndarr

    Run Houndarr's full quality gate (ruff lint, ruff format check, mypy, bandit, pytest) and report results in a single table.

    292 GitHub stars~366 tokensUpdated 4 days ago
    Testing & QAAuto-check passed

  • Validate

    juliepy/AI-Engineer-from-scrach

    Run the full quality gate (ruff + mypy + pytest + tsc + vitest) and report PASS/FAIL for each command.

    436 GitHub stars~500 tokensUpdated 1 mo ago
    Testing & QAAuto-check passed

  • Modern Python

    antoinebou12/uml-mcp

    Modern Python tooling and best practices using uv, ruff, ty, and pytest.

    105 GitHub stars~1k tokensUpdated today
    DevelopmentAuto-check passed

Works with

Categories

Questions about Dependency Pins

What does Dependency Pins do?

A skill your agent uses when bumping any dependency, upgrading the HA test harness (pytest-homeassistant-custom-component) or HA floor, or handling Dependabot PRs/security alerts — per-package pin…. Dependency Pins is an agent skill from cognitivegears/ha-escpos-thermal-printer. Use when bumping any dependency, upgrading the HA test harness (pytest-homeassistant-custom-component) or HA floor, or handling Dependabot PRs/security alerts — per-package pin rationale for pytest, mypy, dbus-fast, Pillow, respx, and serialx, all of which are constrained by Home Assistant or the test harness.

When should I use Dependency Pins?

Dependency Pins fits situations like: bumping any dependency; upgrading the HA test harness (pytest-homeassistant-custom-component); handling Dependabot PRs/security alerts — per-package pin rationale for pytest; all of which are constrained by Home Assistant.

How do I install Dependency Pins in Claude Code?

Run `npx skills add cognitivegears/ha-escpos-thermal-printer --skill dependency-pins -a claude-code`. Or copy the skill folder (.claude/skills/dependency-pins in cognitivegears/ha-escpos-thermal-printer) into .claude/skills/dependency-pins in your project. Claude Code loads it when a task matches its description.

How do I install Dependency Pins in Codex?

Run `npx skills add cognitivegears/ha-escpos-thermal-printer --skill dependency-pins -a codex`. Or copy the skill folder (.claude/skills/dependency-pins in cognitivegears/ha-escpos-thermal-printer) into .agents/skills/dependency-pins in your project. Codex loads it when a task matches its description.

Can I use Dependency Pins in Cursor, Gemini CLI or GitHub Copilot?

Cursor, Gemini CLI, GitHub Copilot and OpenCode also load SKILL.md folders. With the skills CLI, run `npx skills add cognitivegears/ha-escpos-thermal-printer --skill dependency-pins -a cursor` (or -a gemini-cli, github-copilot or opencode for the others). To copy it by hand, put the folder in .cursor/skills/dependency-pins, .gemini/skills/dependency-pins, .github/skills/dependency-pins and .opencode/skills/dependency-pins in your project.

What does Dependency Pins need to run?

Going by SKILL.md and its folder, Dependency Pins needs the command-line tools its instructions call (uv).

Does Dependency Pins access the network?

SKILL.md contains no URLs. Its commands use uv, which can reach the network depending on how they are called. This is read from the text; nothing was executed.

Is Dependency Pins safe to install?

Our automated static check of SKILL.md found no risky patterns, such as piping downloads into a shell, reading credential files or hidden Unicode. It is not a guarantee. Review the folder before installing.

What licence does Dependency Pins use?

Dependency Pins is published under the MIT licence (the repository's licence). It allows redistribution, so the full SKILL.md is shown on this page.

How many tokens does Dependency Pins use?

About 1.1k tokens (SKILL.md is roughly 4.4k characters). Agents keep only the skill's name and description in context until a task matches; then they load SKILL.md in full.

What are the alternatives to Dependency Pins?

Skills that share tags, products or a category with Dependency Pins: Kedro Babysit (kedro-org/kedro, 11k stars), Issue Writer (NVIDIA/container-canary, 308 stars), Ha Integration Testing (FutureTense/keymaster, 349 stars) and Check (av1155/houndarr, 292 stars). The comparison table on this page puts their stars, adoption, token cost, safety result and licence side by side.

Who maintains Dependency Pins?

cognitivegears (a GitHub user) maintains it in cognitivegears/ha-escpos-thermal-printer, which has 112 GitHub stars. The repository was last updated on October 5, 2026.

Source: cognitivegears/ha-escpos-thermal-printer on GitHub. Facts on this page come from the repository at the commit we read; the author's words are quoted as theirs.