Home / konglong87 / superpm · GitHub

super-pm-upgrade SKILL.md skillA

super-pm-upgrade from konglong87/superpm is an agent skill: a SKILL.md folder an AI agent loads when a task calls for it.

Install it, pinned

mdr add konglong87/superpm/super-pm-upgrade@git:20260924.26fb3bb

Pins git:20260924.26fb3bb in mdr.lock. Pin the fingerprint instead.

Audit grade: A, 17 of 17 checks passed
Kind: SKILL.md skill
Repository: konglong87/superpm
Path: skills/super-pm-upgrade/SKILL.md
Versions recorded: 5
Latest version: git:20260924.26fb3bb, committed Sep 24, 2026
First version recorded: Jul 2, 2026
Size: 2,837 bytes
Repository stars: 86
License: MIT

Use when: 用户要求检查 super-pm 更新、升级完整 Git 安装或回退 Do NOT use when: 正在执行普通 PM 任务、仅需安装健康检查或用户没有要求升级.

Collected from public GitHub. Every version is saved exactly as it was and never changes. Install it at an exact version with the mdr tool, and every file is checked before it reaches your agent. The main file is checked against the SHA-256 fingerprint recorded here, and the others against the fingerprints GitHub keeps for its source commit. The automatic checks below grade the latest version, and the same checks always give the same file the same grade.

What the file says

# 安全升级 super-pm

**绝不在用户的业务项目仓库中运行升级用 Git 命令。** 从已加载的本 SKILL.md 找到同目录的 `scripts/package-root.sh`，执行它获取技能包 Git 根目录。此脚本使用自身真实位置定位，不依赖当前工作目录。

```bash
PACK_ROOT="$(bash "<当前 super-pm-upgrade skill 的绝对目录>/scripts/package-root.sh")" || exit 2
printf 'super-pm package: %s\n' "$PACK_ROOT"
```

如果该命令失败，当前为复制安装或非 Git 安装；**停止 Git 升级流程**，根据安装方式使用 `npx skills update` 或平台自己的更新机制。不要退回 `git pull` 用户当前项目。

## 检查（只读，网络 fetch 除外）

每次调用 Bash 工具时重新设置绝对的 `PACK_ROOT`，或显式将命令的工作目录设为该包。以下所有 `git` 命令必须带 `-C "$PACK_ROOT"`：

```bash
PACK_ROOT="$(bash "<当前 skill 绝对目录>/scripts/package-root.sh")" || exit 2
git -C "$PACK_ROOT" status --short
git -C "$PACK_ROOT" branch --show-current
cat "$PACK_ROOT/VERSION"
git -C "$PACK_ROOT" fetch origin main --tags
git -C "$PACK_ROOT" log -1 --oneline HEAD
git -C "$PACK_ROOT" log -1 --oneline origin/main
```

比较当前 HEAD 与 `origin/main`。有未提交改动、非快进、未处在预期分支或远程不可用时停止并说明，不自动 stash、重置、切换分支或覆盖文件。用户仅要求“检查”时到此为止。

## 执行升级（需要用户明确确认）

告知用户目标提交、当前版本和影响后确认。确认前不运行以下命令：

```bash
PACK_ROOT="$(bash "<当前 skill 绝对目录>/scripts/package-root.sh")" || exit 2
OLD_COMMIT="$(git -C "$PACK_ROOT" rev-parse HEAD)"
test -z "$(git -C "$PACK_ROOT" status --porcelain)" || exit 1
…

Read the whole file at its exact version.

How to install

The exact contents, by fingerprint

mdr add konglong87/superpm/super-pm-upgrade@sha256:5c5ee044ecdfbb61

The line at the top of this page pins the label git:20260924.26fb3bb, which is what most people want. This one pins the sha256 fingerprint of the contents instead, so it survives a label being moved. Either way the exact version is written to mdr.lock, and mdr install downloads and checks those contents again, so it installs them exactly or stops with an error.

Badge

[![mdr](https://markdownregistry.com/badge/art_mkf6mbshrigsnyfb.svg)](https://markdownregistry.com/a/art_mkf6mbshrigsnyfb)

2 badge image fetches in 30 days. What the badge shows.

Versions

The registry has recorded 5 versions of this file, between Jul 2, 2026 and Sep 24, 2026, about one every 21 days.

version	committed	commit	size	audit
git:20260924.26fb3bb latest	2026-09-24	26fb3bb	2,837 B	A	view · diff
git:20260730.2cdc0a4	2026-07-30	2cdc0a4	6,675 B	A	view · diff
git:20260730.fea8df7	2026-07-30	fea8df7	6,398 B	A	view · diff
git:20260730.1745f93	2026-07-30	1745f93	6,723 B	A	view · diff
git:20260702.72f7781	2026-07-02	72f7781	6,180 B	A	view

Audit of the latest version

A 17 of 17 checks passed. Fixed automatic checks with no AI involved, so the same checks give the same answer every run.

pass: Frontmatter block present
pass: Frontmatter declares a name
pass: Frontmatter declares a description
pass: Size between 200 bytes and 200 KB (2837 bytes)
pass: No zero-width or bidi control characters
pass: No instruction hidden inside an HTML comment
pass: No link to an exfiltration or paste host
pass: No credential-shaped string
pass: No instruction to send local credentials anywhere
pass: No text hidden with inline styles
pass: No prompt-injection phrasing
pass: No curl or wget piped into a shell
pass: No recursive delete of root, home or parent
pass: No instruction to read or print local credentials
pass: No base64 blob over 200 characters
pass: No link to a raw IP address
pass: No script tag

Source

GitHub

konglong87/superpm · 86 stars · license MIT · pushed 2026-10-26 · branch main

API

GET https://markdownregistry.com/api/v1/artifacts/art_mkf6mbshrigsnyfb
GET https://markdownregistry.com/api/v1/resolve?ref=konglong87/superpm/super-pm-upgrade
GET https://markdownregistry.com/api/v1/blob/5c5ee044ecdfbb6151ca31de49e6604f8e6f19c10498376eddf1fa2de7bb0bfc

Your AI assistant does the legwork. You hear about the deals worth your word. Hand yours the standing instructions at modelranch.com and it joins the network that reads files like this one.

Guides: the SKILL.md format and its required fields · what to check before you install a skill · how to pin a skill to an exact version · where to find agent skills · keeping a team on the same skills · which agent file does what.