Agent skill

Deps Bump

Safely update Txtify dependencies or resolve Dependabot alerts.

Apache-2.0Auto-check passedDevelopment

Install Deps Bump

skills CLI

$ npx skills add lkmeta/txtify --skill deps-bump -a claude-code

Project install by default; add -g for ~/.claude/skills/.

GitHub CLI

$ gh skill install lkmeta/txtify deps-bump --agent claude-code

Project scope by default; add --scope user for a personal install. Needs GitHub CLI 2.90.0 or later (public preview).

Manual copy

$ git clone --depth 1 https://github.com/lkmeta/txtify.git skills-src && mkdir -p .claude/skills && cp -r skills-src/.claude/skills/deps-bump .claude/skills/deps-bump && rm -rf skills-src

Use ~/.claude/skills/ instead of .claude/skills for a personal install. The folder must contain SKILL.md.

Claude Code skills documentation · loads skills from .claude/skills/

Paste into Claude Code

Install the "deps-bump" agent skill from https://github.com/lkmeta/txtify/tree/main/.claude/skills/deps-bump into .claude/skills/deps-bump/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "deps-bump", then confirm the skill loads.

Claude Code copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.

$skill-installer

$skill-installer install https://github.com/lkmeta/txtify/tree/main/.claude/skills/deps-bump

Type this inside Codex. $skill-installer <name> installs a curated skill from openai/skills. The installer writes to $CODEX_HOME/skills (default ~/.codex/skills). Restart Codex if the skill does not show up.

skills CLI

$ npx skills add lkmeta/txtify --skill deps-bump -a codex

Project install goes to .agents/skills/; add -g for ~/.codex/skills/.

GitHub CLI

$ gh skill install lkmeta/txtify deps-bump --agent codex

Project scope by default (.agents/skills/); add --scope user for a personal install.

Manual copy

$ git clone --depth 1 https://github.com/lkmeta/txtify.git skills-src && mkdir -p .agents/skills && cp -r skills-src/.claude/skills/deps-bump .agents/skills/deps-bump && rm -rf skills-src

Use ~/.agents/skills/ instead of .agents/skills for a personal install.

Codex skills documentation · loads skills from .agents/skills/

Paste into Codex

Install the "deps-bump" agent skill from https://github.com/lkmeta/txtify/tree/main/.claude/skills/deps-bump into .agents/skills/deps-bump/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "deps-bump", then confirm the skill loads.

Codex copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.

skills CLI

$ npx skills add lkmeta/txtify --skill deps-bump -a cursor

Project install goes to .agents/skills/; add -g for ~/.cursor/skills/.

GitHub CLI

$ gh skill install lkmeta/txtify deps-bump --agent cursor

Project scope by default (.agents/skills/); add --scope user for a personal install.

Manual copy

$ git clone --depth 1 https://github.com/lkmeta/txtify.git skills-src && mkdir -p .cursor/skills && cp -r skills-src/.claude/skills/deps-bump .cursor/skills/deps-bump && rm -rf skills-src

Use ~/.cursor/skills/ instead of .cursor/skills for a personal install.

Cursor skills documentation · loads skills from .cursor/skills/, .agents/skills/, .claude/skills/, .codex/skills/

Paste into Cursor

Install the "deps-bump" agent skill from https://github.com/lkmeta/txtify/tree/main/.claude/skills/deps-bump into .cursor/skills/deps-bump/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "deps-bump", then confirm the skill loads.

Cursor copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.

gemini skills install

$ gemini skills install https://github.com/lkmeta/txtify.git --path .claude/skills/deps-bump

--scope user (default) or --scope workspace; --path is the subfolder of the repo that holds the skill; --consent skips the security confirmation prompt.

skills CLI

$ npx skills add lkmeta/txtify --skill deps-bump -a gemini-cli

Project install goes to .agents/skills/; add -g for ~/.gemini/skills/.

GitHub CLI

$ gh skill install lkmeta/txtify deps-bump --agent gemini-cli

Project scope by default (.agents/skills/); add --scope user for a personal install.

Manual copy

$ git clone --depth 1 https://github.com/lkmeta/txtify.git skills-src && mkdir -p .gemini/skills && cp -r skills-src/.claude/skills/deps-bump .gemini/skills/deps-bump && rm -rf skills-src

Use ~/.gemini/skills/ instead of .gemini/skills for a personal install, then run /skills reload.

Gemini CLI skills documentation · loads skills from .gemini/skills/, .agents/skills/

Paste into Gemini CLI

Install the "deps-bump" agent skill from https://github.com/lkmeta/txtify/tree/main/.claude/skills/deps-bump into .gemini/skills/deps-bump/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "deps-bump", then confirm the skill loads.

Gemini CLI copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.

GitHub CLI

$ gh skill install lkmeta/txtify deps-bump

Installs for Copilot at project scope by default; add --scope user for a personal install. Preview a skill first with gh skill preview. Needs GitHub CLI 2.90.0 or later (public preview).

skills CLI

$ npx skills add lkmeta/txtify --skill deps-bump -a github-copilot

Project install goes to .agents/skills/; add -g for ~/.copilot/skills/.

Manual copy

$ git clone --depth 1 https://github.com/lkmeta/txtify.git skills-src && mkdir -p .github/skills && cp -r skills-src/.claude/skills/deps-bump .github/skills/deps-bump && rm -rf skills-src

Use ~/.copilot/skills/ instead of .github/skills for a personal install. Commit .github/skills so cloud agent and code review can use it.

GitHub Copilot skills documentation · loads skills from .github/skills/, .claude/skills/, .agents/skills/

Paste into GitHub Copilot

Install the "deps-bump" agent skill from https://github.com/lkmeta/txtify/tree/main/.claude/skills/deps-bump into .github/skills/deps-bump/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "deps-bump", then confirm the skill loads.

GitHub Copilot copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.

skills CLI

$ npx skills add lkmeta/txtify --skill deps-bump -a opencode

OpenCode documents no install command of its own. Project install goes to .agents/skills/; add -g for ~/.config/opencode/skills/.

GitHub CLI

$ gh skill install lkmeta/txtify deps-bump --agent opencode

Project scope by default (.agents/skills/); add --scope user for a personal install.

Manual copy

$ git clone --depth 1 https://github.com/lkmeta/txtify.git skills-src && mkdir -p .opencode/skills && cp -r skills-src/.claude/skills/deps-bump .opencode/skills/deps-bump && rm -rf skills-src

Use ~/.config/opencode/skills/ instead of .opencode/skills for a personal install.

OpenCode skills documentation · loads skills from .opencode/skills/, .claude/skills/, .agents/skills/

Paste into OpenCode

Install the "deps-bump" agent skill from https://github.com/lkmeta/txtify/tree/main/.claude/skills/deps-bump into .opencode/skills/deps-bump/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "deps-bump", then confirm the skill loads.

OpenCode copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.

Facts

Skill name: deps-bump
GitHub stars: 135
Token cost: ~585 tokens
SKILL.md length: 220 words
Files: 1
Skills in repo: 2
Repo updated: Aug 15, 2026
First seen: Oct 7, 2026
Licence: Apache-2.0

At a glance

Safely update Txtify dependencies or resolve Dependabot alerts.

Works in 5 steps: torch and torchaudio move together, same… → stable-ts ≥ 2.19.1 so pip resolves an… → Before adding any package, and before… → …
Asked to bump packages
SKILL.md covers Ground rules, Checking alerts and Verification (non-negotiable)
Calls gh; reaches youtube.com

What it does

Deps Bump is an agent skill from lkmeta/txtify. Safely update Txtify dependencies or resolve Dependabot alerts. Use when asked to bump packages, fix security alerts, or when a Dependabot PR appears.

Its SKILL.md is about 590 tokens, which your agent loads only when the skill is triggered. It is a single SKILL.md file with no bundled scripts.

It sits in Development, covering Dependency management and Speech recognition and synthesis. It works with Docker, FastAPI and Python. The repository describes itself as: Web application that converts audio and video to text using AI, supporting various formats and self-hosting. The licence is Apache-2.0.

When your agent uses it

Asked to bump packages
Fix security alerts
A Dependabot PR appears

Example prompts

“/deps-bump”

Requirements

Python 3
Docker

Workflow steps

5 steps, taken from the first numbered list in SKILL.md.

torch and torchaudio move together, same version. A mismatch doesn't fail the build — it crashes the worker at import, and jobs just hang…
stable-ts ≥ 2.19.1 so pip resolves an openai-whisper that builds under modern setuptools (older ones import pkg_resources in setup.py and…
Before adding any package, and before "fixing" an alert on one: check it's actually imported — grep -rn '' src/. Unused packages get…
yt-dlp rots fastest and breaks YouTube downloads silently. After bumping, verify with a real download (host venv is fine)
Runtime deps go in requirements.txt; test-only deps (pytest, httpx, pypdf) in requirements-dev.txt. Don't ship test tooling in the image.

What it can do on your machine

Read from SKILL.md and the folder at commit b54c884. It shows what the files ask for, not the result of running them.

Tool permissions
Pre-approves nothing: there is no allowed-tools line, so your agent's usual permission prompts apply.
From allowed-tools in the SKILL.md frontmatter.
Runs code
Shell commands in SKILL.md call:
- gh
From the folder's file list and the shell code blocks in SKILL.md.
Network
Hosts in commands or code, which the agent is likely to contact:
- youtube.com
From URLs in SKILL.md, links to its own repository left out.
Credentials
Names no API keys, tokens, secrets or passwords.
From names ending in _API_KEY, _TOKEN, _SECRET, _KEY or _PASSWORD in SKILL.md.

Context cost

Deps Bump loads about 585 tokens when it runs. Until then it costs about 40 tokens; SKILL.md has 220 words of instructions outside code blocks.

Always · name and description, kept in context so the agent knows when to use it: ~40
When it runs · the whole SKILL.md, loaded when a task matches: ~585

Estimates: characters ÷ 4, the usual rule of thumb; real counts depend on the model's tokenizer. Scripts and assets cost tokens only if the agent reads them.

Safety

Auto-check passed

The automated check found no risky patterns in SKILL.md.

Automated static check — not a guarantee. Review scripts before installing. It scans the text of SKILL.md for risky patterns (piping downloads into a shell, reading credential files, hidden Unicode, destructive commands); files beside SKILL.md are not scanned.

SKILL.md

The full file from lkmeta/txtify at commit b54c884, republished under its Apache-2.0 licence (© lkmeta). 220 words, ~585 tokens.

Download SKILL.mdSave it as .claude/skills/deps-bump/SKILL.md (or your agent's skills folder).

name: deps-bump
description: Safely update Txtify dependencies or resolve Dependabot alerts. Use when asked to bump packages, fix security alerts, or when a Dependabot PR appears.

Dependency updates for Txtify

Ground rules

torch and torchaudio move together, same version. A mismatch doesn't fail the build — it crashes the worker at import, and jobs just hang at 10%. This is the #1 trap.
stable-ts ≥ 2.19.1 so pip resolves an openai-whisper that builds under modern setuptools (older ones import pkg_resources in setup.py and break the Docker build). Check stable-ts's openai-whisper constraint before bumping torch far ahead.
Before adding any package, and before "fixing" an alert on one: check it's actually imported — grep -rn '<pkg>' src/. Unused packages get deleted, not bumped (transformers/accelerate/srt/webvtt-py died this way).

yt-dlp rots fastest and breaks YouTube downloads silently. After bumping, verify with a real download (host venv is fine):

python

import yt_dlp
opts = {"format": "bestaudio/best", "postprocessors": [{"key": "FFmpegExtractAudio", "preferredcodec": "mp3", "preferredquality": "192"}], "outtmpl": "yt_test.%(ext)s", "quiet": True}
yt_dlp.YoutubeDL(opts).download(["https://www.youtube.com/watch?v=jNQXAC9IVRw"])  # 19s clip

Runtime deps go in requirements.txt; test-only deps (pytest, httpx, pypdf) in requirements-dev.txt. Don't ship test tooling in the image.

Checking alerts

gh api repos/lkmeta/txtify/dependabot/alerts --paginate \
  --jq '.[] | select(.state=="open") | [.security_advisory.severity, .dependency.package.name, .security_vulnerability.vulnerable_version_range, (.security_vulnerability.first_patched_version.identifier // "none")] | @tsv'

Pick the newest version that is explicitly patched in the alert set rather than blindly taking latest — conservative for the ML stack, current for everything else. Alerts auto-resolve after GitHub rescans the updated manifest (minutes to hours); don't chase the counter.

Verification (non-negotiable)

Any requirements.txt change requires the full Docker E2E — the unit tests stub the ML stack and will pass even when the worker can't import: run the verify skill, Tier 2 (./scripts/docker_e2e.sh → PASS: docker E2E complete).

Files

Just SKILL.md in .claude/skills/deps-bump of lkmeta/txtify.

Open the folder on GitHubat commit b54c884

Compare with similar skills

Deps Bump next to the 5 skills that share the most tags, products or categories with it. Stars are the repository's; “used in” counts other GitHub owners with a copy.

Deps Bump compared with similar skills
Skill	Stars	Used in	Tokens	Auto-check	Licence	Repo updated
Deps Bump this skilllkmeta/txtify	135	—	~585	Automated safety check: Pass	Apache-2.0	1 mo ago
Flowfile Debugging PlaybookEdwardvaneechoud/Flowfile	375	—	~6.3k	Automated safety check: Pass	MIT	today
Sync Dependabot App Depsossf/oss-crs	165	—	~1.7k	Automated safety check: Notes	MIT	3 days ago
AzureML Project ScaffoldingKilo-Org/kilo-marketplace	190	—	~3.1k	Automated safety check: Notes	MIT	11 days ago
Flowfile Build and Environment SetupEdwardvaneechoud/Flowfile	375	—	~7.3k	Automated safety check: Notes	MIT	today
Pre Pushartcc/freelingo	162	—	~732	Automated safety check: Pass	AGPL-3.0	yesterday

Similar skills

Flowfile Debugging Playbook
Edwardvaneechoud/Flowfile
Symptom-to-cause triage playbook for Flowfile (core/worker/kernel/frontend/AI) — covers "no such table" DB cascades (two distinct causes), import-time Alembic migration corruption, silent…
375 GitHub stars~6.3k tokensUpdated today
DevelopmentAuto-check passed
Sync Dependabot App Deps
ossf/oss-crs
Read every open Dependabot PR for an application-code dependency (Python pip/uv and JS npm/yarn/pnpm) and carry each version bump over to the local dependency files (requirements.txt…
165 GitHub stars~1.7k tokensUpdated 3 days ago
DevelopmentAuto-check: notes
AzureML Project Scaffolding
Kilo-Org/kilo-marketplace
Sets up and maintains AzureML-ready Python projects as uv workspaces with devcontainers, a Makefile and job YAML, so local runs match cloud jobs and experiments stay reproducible.
190 GitHub stars~3.1k tokensUpdated 11 days ago
DevelopmentAuto-check: notes
Flowfile Build and Environment Setup
Edwardvaneechoud/Flowfile
Recreates every Flowfile development and build environment from scratch, with exact version pins and an explanation of what each Makefile target really does.
375 GitHub stars~7.3k tokensUpdated today
DevelopmentAuto-check: notes
Pre Push
artcc/freelingo
A skill your agent uses when the user asks to check before pushing, pre-push, verificar antes de pushear, run all checks, or quiere validar que todo pasa antes de hacer push.
162 GitHub stars~732 tokensUpdated yesterday
EducationAuto-check passed
Code Review Security
nicepkg/auto-company
Security-focused code review checklist and automated scanning patterns.
194 GitHub starsUsed in 1 repo~3.9k tokens
SecurityAuto-check passed

Questions about Deps Bump

What does Deps Bump do?

Safely update Txtify dependencies or resolve Dependabot alerts. Deps Bump is an agent skill from lkmeta/txtify. Safely update Txtify dependencies or resolve Dependabot alerts.

When should I use Deps Bump?

Deps Bump fits situations like: asked to bump packages; fix security alerts; A Dependabot PR appears.

How do I install Deps Bump in Claude Code?

Run `npx skills add lkmeta/txtify --skill deps-bump -a claude-code`. Or copy the skill folder (.claude/skills/deps-bump in lkmeta/txtify) into .claude/skills/deps-bump in your project. Claude Code loads it when a task matches its description.

How do I install Deps Bump in Codex?

Run `npx skills add lkmeta/txtify --skill deps-bump -a codex`. Or copy the skill folder (.claude/skills/deps-bump in lkmeta/txtify) into .agents/skills/deps-bump in your project. Codex loads it when a task matches its description.

Can I use Deps Bump in Cursor, Gemini CLI or GitHub Copilot?

Cursor, Gemini CLI, GitHub Copilot and OpenCode also load SKILL.md folders. With the skills CLI, run `npx skills add lkmeta/txtify --skill deps-bump -a cursor` (or -a gemini-cli, github-copilot or opencode for the others). To copy it by hand, put the folder in .cursor/skills/deps-bump, .gemini/skills/deps-bump, .github/skills/deps-bump and .opencode/skills/deps-bump in your project.

What does Deps Bump need to run?

Going by SKILL.md and its folder, Deps Bump needs the command-line tools its instructions call (gh). Our summary lists: Python 3; Docker.

Does Deps Bump access the network?

SKILL.md names 1 domain. In commands or code: youtube.com; the agent is likely to contact it when it follows the instructions. This is read from the text; nothing was executed.

Is Deps Bump safe to install?

Our automated static check of SKILL.md found no risky patterns, such as piping downloads into a shell, reading credential files or hidden Unicode. It is not a guarantee. Review the folder before installing.

What licence does Deps Bump use?

Deps Bump is published under the Apache-2.0 licence (the repository's licence). It allows redistribution, so the full SKILL.md is shown on this page.

How many tokens does Deps Bump use?

About 585 tokens (SKILL.md is roughly 2.3k characters). Agents keep only the skill's name and description in context until a task matches; then they load SKILL.md in full.

What are the alternatives to Deps Bump?

Skills that share tags, products or a category with Deps Bump: Flowfile Debugging Playbook (Edwardvaneechoud/Flowfile, 375 stars), Sync Dependabot App Deps (ossf/oss-crs, 165 stars), AzureML Project Scaffolding (Kilo-Org/kilo-marketplace, 190 stars) and Flowfile Build and Environment Setup (Edwardvaneechoud/Flowfile, 375 stars). The comparison table on this page puts their stars, adoption, token cost, safety result and licence side by side.

Who maintains Deps Bump?

lkmeta (a GitHub user) maintains it in lkmeta/txtify, which has 135 GitHub stars. The repository holds 2 skills in this directory. The repository was last updated on August 15, 2026.

Source: lkmeta/txtify on GitHub. Facts on this page come from the repository at the commit we read; the author's words are quoted as theirs.

Deps Bump

Install Deps Bump

Facts

At a glance

What it does

When your agent uses it

Example prompts

Requirements

Workflow steps

What it can do on your machine

Tool permissions

Runs code

Network

Credentials

Context cost

Safety

SKILL.md

Dependency updates for Txtify

Ground rules

Checking alerts

Verification (non-negotiable)

Files

Compare with similar skills

Similar skills

Flowfile Debugging Playbook

Sync Dependabot App Deps

AzureML Project Scaffolding

Flowfile Build and Environment Setup

Pre Push

Code Review Security

More from lkmeta/txtify

Verify

Questions about Deps Bump

Install Deps Bump

Facts

At a glance

What it does

When your agent uses it

Example prompts

Requirements

Workflow steps

What it can do on your machine

Tool permissions

Runs code

Network

Credentials

Context cost

Safety

SKILL.md

Dependency updates for Txtify

Ground rules

Checking alerts

Verification (non-negotiable)

Files

Compare with similar skills

Similar skills

Flowfile Debugging Playbook

Sync Dependabot App Deps

AzureML Project Scaffolding

Flowfile Build and Environment Setup

Pre Push

Code Review Security

More from lkmeta/txtify

Verify

Related

Questions about Deps Bump