How does it identify breaking changes?

The skill performs a structural diff of the package's source code and compares exports, function signatures, and return values against how the project currently utilizes the library.

Does it support private registries?

Yes, as long as your local environment is authenticated with the registry, the skill can use standard npm/yarn commands to fetch package metadata and tarballs.

Why use this instead of just reading the changelog?

Changelogs are often incomplete or may miss internal logic changes; this skill performs a deep code-level analysis of the actual distribution files to find undocumented changes.

Can it post results directly to my Pull Request?

Yes, it uses the GitHub CLI (gh) to post a comprehensive compatibility report as a comment on the relevant Pull Request for team review.

Package Upgrade Auditor

Name: Package Upgrade Auditor
Author: OneKeyHQ

byOneKeyHQ

•

2,309

•

Security & Testing

Audits npm package version upgrades by performing source-level diffs and tracing call sites to ensure project compatibility.

The Package Upgrade Auditor skill automates the critical process of vetting third-party dependency updates. Instead of relying solely on changelogs, it downloads the source code for both the old and new versions from the npm registry, performs a structural diff, and identifies breaking changes in API signatures, return values, or side effects. It then maps these changes against your project's specific call sites to verify compatibility. This tool is essential for maintaining supply chain security and preventing regressions during Dependabot, Renovate, or manual dependency updates by providing a structured risk report directly in your PR comments.

Key Features

01Automated source-level diffing between package versions

02Deep call site tracing to identify impacted files in your codebase

03Automated compatibility report generation in Markdown

04Classification of API signature and return type changes

05Direct GitHub PR integration for collaborative review

062,309 GitHub stars

Use Cases

01Analyzing breaking changes during major version library migrations

02Vetting Dependabot or Renovate PRs before merging to production

03Investigating regressions introduced by patch or minor version updates

What are Skills?·How to Install

Install with 🐟 Skill.Fish

npx skillfish add onekeyhq/app-monorepo 1k-pkg-upgrade-review

For use in Claude.ai and ChatGPT

Download Skill