millerlai

Auto Package Migration — Security skill for Claude Code

Security community

A Claude Code Skill that automates package upgrades, CVE remediation, and Jira-driven dependency maintenance across Python (pip/poetry/uv), JavaScript/TypeScript (npm/yarn 3), and Go modules.

How to install Auto Package Migration

This entry records only its repository, not the path inside it, so there is no exact command to give. Open millerlai/auto-package-migration and copy the folder into ~/.claude/skills/, or the file into ~/.claude/agents/.

What Auto Package Migration does

A Claude Code Skill that automates package upgrades, CVE remediation, and Jira-driven dependency maintenance across Python (pip/poetry/uv), JavaScript/TypeScript (npm/yarn 3), and Go modules. Runs a 7-phase pipeline: detect → analyze deps → review breaking changes → patch code via AST → test → commit/PR/Jira write-back.

Alternatives in Security

Cve MCP Server — Production-grade MCP server giving Claude 27 security intelligence tools across 21 APIs — CVE lookup, EPSS sco 1.2k ★
Engage.Cvediff — Find the canonical fix commit(s) for a CVE across sources, then diff for root cause 348 ★
Reactnative Expo AI Agent System Workflow — AI-powered development toolkit with 7 production agents for React Native/Expo mobile apps 125 ★

README

Package Upgrade Skill for Claude Code

[繁體中文](README.zh-TW.md) · English

A [Claude Code Skill](https://docs.claude.com/en/docs/claude-code/skills) that automates package upgrades, CVE remediation, and Jira-driven maintenance work across **Python**, **JavaScript / TypeScript**, and **Go**. One workflow takes you from trigger → dependency analysis → breaking-change review → code edits → test verification → commit / PR / Jira write-back.

🚀 Quick start

# Install — macOS / Linux (global, recommended)
bash install.sh
bash install.sh --project          # project-local install (./.claude/skills/)
bash install.sh --skip-permissions # don't write to Claude Code settings.json

# Install — Windows (PowerShell / cmd)
install.bat

# Install — Cygwin64 / Git Bash / MSYS2 (also installs the gh CLI)
bash install-cygwin64.sh

# Verify — macOS / Linux
bash verify_installation.sh

# Verify — Windows (PowerShell / cmd)
verify_installation.bat

# Verify — Cygwin64 / Git Bash / MSYS2
bash verify_installation_cygwin64.sh

# Uninstall — same flags as install (--global default / --project)
bash uninstall.sh                  # macOS / Linux
uninstall.bat                      # Windows (PowerShell / cmd)
bash uninstall-cygwin64.sh         # Cygwin64 / Git Bash / MSYS2

Uninstall fingerprints each target (SKILL.md `name:` + signature files) before deleting, so a third-party skill that merely shares the `package-upgrade` name is left untouched. It also removes the provenance Stop hook from `settings.json` (pass `--skip-permissions` to leave settings alone).

Two ways to invoke once installed:

**A) One-shot from the shell** — start Claude with the prompt:

claude "upgrade requests to 2.32.0"
claude "bump axios to 1.7.0"
claude "go get -u github.com/spf13/cobra@v1.8.0"
claude "fix CVE-2024-35195"
claude "V1E-148968"                                          # Jira issue key
claude "https://trendmicro.atlassian.net/browse/V1E-148968"  # Jira