메뉴
Reviews package version upgrades — diffs source between versions, traces call sites, and generates compatibility reports.
Codex 또는 Claude로 설치 이 Prompt를 복사해 Codex, Claude 또는 다른 어시스턴트에 붙여 넣으면 Skill 페이지를 검토하고 설치를 진행할 수 있습니다.
SOC 직업 분류 기준
| name | 1k-pkg-upgrade-review |
| description | Reviews package version upgrades — diffs source between versions, traces call sites, and generates compatibility reports. |
| disable-model-invocation | true |
| allowed-tools | Read, Grep, Glob, Bash, WebFetch, Write |
Evaluates npm/yarn package version upgrades by performing source-level diff analysis, tracing all call sites, and producing a structured compatibility report.
Output language: Chinese (matching team conventions).
| Topic | Guide | Description |
|---|---|---|
| Review workflow | review-workflow.md | Step-by-step review process |
| Report template | report-template.md | Output format and risk guidelines |
| Example report | example-report.md | Real case: @isaacs/brace-expansion 5.0.0 -> 5.0.1 |
yarn upgrade or npm update changesyarn.lock or package-lock.jsonnode_modules for indirect usage via intermediate packagesnode_modules/.cache/pkg-upgrade/gh pr comment# Download and extract both versions for diffing
mkdir -p /tmp/pkg-diff && cd /tmp/pkg-diff
curl -sL $(npm view PKG@OLD_VER dist.tarball) | tar xz -C old
curl -sL $(npm view PKG@NEW_VER dist.tarball) | tar xz -C new
# Compare file lists
diff -rq old/package new/package
# Diff main source
diff old/package/dist/commonjs/index.js new/package/dist/commonjs/index.js
# Search project code for direct usage
grep -r "PACKAGE_NAME" --include="*.ts" --include="*.tsx" --include="*.js" -l . \
--exclude-dir=.git --exclude-dir=node_modules
# Search node_modules for indirect usage
grep -rn "from ['\"]PACKAGE_NAME['\"]" node_modules/ --include="*.js" --include="*.mjs" \
| grep -v "node_modules/.cache"
# Check package metadata
npm view PKG@NEW_VER deprecated
npm view PKG@NEW_VER dist.integrity
node_modules/.cache/pkg-upgrade/<package-name>-<old>-to-<new>.mdgh pr comment/1k-code-review-pr - Comprehensive PR code review (security, code quality, platform patterns)Analytics event tracking for OneKey. Use when adding tracking events, logging to server, user behavior tracking, or business metrics. Covers the @LogToServer decorator pattern, logger scope/scene architecture, and common pitfalls. Triggers on "埋点", "统计", "打点", "数据追踪", "日志", "analytics", "tracking event", "Mixpanel", "LogToServer", "trackEvent", "defaultLogger".
Create test versions to verify app auto-update functionality and version migration.
Release branch management — checkout from release, prepare builds, pre-release diff checks, publish tracking, and sync back to x. Use this skill when managing release branches, creating branches for bundle releases, running pre-release diff checks, finalizing releases, or syncing release changes to x. Triggers on "bundle release", "release diff", "release publish", "release sync", "release checkout", "发布管理", "release 分支", "release management", "bundle-release", "bundle branch".
Code quality standards — lint (eslint/oxlint), type check (tsc), pre-commit hooks, and comment conventions. All comments must be in English.
Comprehensive PR code review for OneKey monorepo. Use when reviewing PRs, code changes, or diffs — covers security (secrets/PII leakage, supply-chain, AuthN/AuthZ), code quality (hooks, race conditions, null safety, concurrent requests), and OneKey-specific patterns (Fabric crashes, MIUI, BigNumber). Triggers on "review PR", "review this PR", "code review", "check this diff", "审查 PR", "代码审查", "review
Coding patterns and best practices — React components, promise handling, and TypeScript conventions.