upstream-tracker SKILL.md skillA
upstream-tracker from voxpelli/claude-beads is an agent skill: a SKILL.md folder an AI agent loads when a task calls for it.
mdr add voxpelli/claude-beads/upstream-tracker@git:20260602.6cb05c5Pins git:20260602.6cb05c5 in mdr.lock. Pin the fingerprint instead.
- Audit grade
- A, 17 of 17 checks passed
- Kind
- SKILL.md skill
- Repository
- voxpelli/claude-beads
- Path
skills/upstream-tracker/SKILL.md- Versions recorded
- 5
- Latest version
- git:20260602.6cb05c5, committed Jun 2, 2026
- First version recorded
- Apr 5, 2026
- Size
- 29,202 bytes
- Repository stars
- 3
- License
- MIT
Manage upstream issue tracking for this project. Use when the user wants to log a bug or friction point in a vendor package or npm dependency, review open upstream items, resolve a tracked issue, run a trend review, generate the upstream observations section of a sprint retrospective, promote upstream observations to Basic Memory, discover known friction from other projects, or track a contribution opportunity. Trigger phrases: 'upstream', 'track this', 'vendor issue', 'log this bug', 'review…
Collected from public GitHub. Every version is saved exactly as it was and never changes. Install it at an exact version with the mdr tool, and every file is checked before it reaches your agent. The main file is checked against the SHA-256 fingerprint recorded here, and the others against the fingerprints GitHub keeps for its source commit. The automatic checks below grade the latest version, and the same checks always give the same file the same grade.
What the file says
# Upstream Tracker
Manage the `UPSTREAM-*.md` files that track bugs, feature requests, contribution
opportunities, and friction discovered in upstream packages while building this
project.
## Tracking Files
### Vendor packages (permanent files)
Vendor packages are declared in `.claude/vendor-registry.json` (if it exists) as
an array of `{prefix, remote, branch, package}` objects, or as packages listed under
`workspaces` in `package.json`. Each vendor package gets a permanent
`UPSTREAM-<package-name>.md` tracking file that always exists, even when empty.
To discover which packages are vendors, read `.claude/vendor-registry.json` if
it exists, or inspect `package.json` workspaces. If neither is present, ask the
user which packages should be treated as permanent vendor fixtures.
### Non-vendor dependencies (ephemeral files)
Any npm dependency can get an `UPSTREAM-<package>.md` file when you encounter a
bug or limitation worth tracking (e.g., `UPSTREAM-umzeption.md`). Create the
file on first encounter. **Delete the file entirely once all its entries are
resolved** — there's no reason to keep an empty tracking file for a regular
…Read the whole file at its exact version.
How to install
mdr add voxpelli/claude-beads/upstream-tracker@sha256:c3767fefb306845aThe line at the top of this page pins the label git:20260602.6cb05c5, which is what most people want. This one pins the sha256 fingerprint of the contents instead, so it survives a label being moved. Either way the exact version is written to mdr.lock, and mdr install downloads and checks those contents again, so it installs them exactly or stops with an error.
[](https://markdownregistry.com/a/art_vh2k7vpsjlbz6pel)
3 badge image fetches in 30 days. What the badge shows.
Versions
The registry has recorded 5 versions of this file, between Apr 5, 2026 and Jun 2, 2026, about one every 14 days.
| version | committed | commit | size | audit | |
|---|---|---|---|---|---|
| git:20260602.6cb05c5 latest | 2026-06-02 | 6cb05c5 | 29,202 B | A | view · diff |
| git:20260508.9643390 | 2026-05-08 | 9643390 | 28,154 B | A | view · diff |
| git:20260506.9ee8eb6 | 2026-05-06 | 9ee8eb6 | 27,921 B | A | view · diff |
| git:20260505.c002713 | 2026-05-05 | c002713 | 27,894 B | A | view · diff |
| git:20260405.fa7ce76 | 2026-04-05 | fa7ce76 | 27,896 B | A | view |
Audit of the latest version
- pass: Frontmatter block present
- pass: Frontmatter declares a name
- pass: Frontmatter declares a description
- pass: Size between 200 bytes and 200 KB (29202 bytes)
- pass: No zero-width or bidi control characters
- pass: No instruction hidden inside an HTML comment
- pass: No link to an exfiltration or paste host
- pass: No credential-shaped string
- pass: No instruction to send local credentials anywhere
- pass: No text hidden with inline styles
- pass: No prompt-injection phrasing
- pass: No curl or wget piped into a shell
- pass: No recursive delete of root, home or parent
- pass: No instruction to read or print local credentials
- pass: No base64 blob over 200 characters
- pass: No link to a raw IP address
- pass: No script tag
Source
voxpelli/claude-beads · 3 stars · license MIT · pushed 2026-10-15 · branch main
API
GET https://markdownregistry.com/api/v1/artifacts/art_vh2k7vpsjlbz6pel GET https://markdownregistry.com/api/v1/resolve?ref=voxpelli/claude-beads/upstream-tracker GET https://markdownregistry.com/api/v1/blob/c3767fefb306845a3d329f0e7336f0d08de022b32f617efa24ff2e8dec01091a
Your AI assistant does the legwork. You hear about the deals worth your word. Hand yours the standing instructions at modelranch.com and it joins the network that reads files like this one.
Guides: the SKILL.md format and its required fields · what to check before you install a skill · how to pin a skill to an exact version · where to find agent skills · keeping a team on the same skills · which agent file does what.