Borrowing it
Nothing to install: this file belongs to b1rdmania/ghostclaw. Take a copy, put it at the same path in your own repository, and replace the rules that are about this project with yours.
curl -O https://raw.githubusercontent.com/b1rdmania/ghostclaw/main/.claude/skills/add-update-check/SKILL.mdgit clone --depth 1 https://github.com/b1rdmania/ghostclawWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/b1rdmania/ghostclaw/add-update-check)<a href="https://agentmods.dev/skills/b1rdmania/ghostclaw/add-update-check"><img src="https://agentmods.dev/badge/skills/b1rdmania/ghostclaw/add-update-check.svg" alt="Measured on agentmods" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00033 | $0.00577 |
| Opus 5 | $0.00016 | $0.00289 |
| Sonnet 5 | $0.00007 | $0.00115 |
| Haiku 4.5 | $0.00003 | $0.00058 |
Grade A, and why
add-update-check scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 8d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 58 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Add Update Check
Registers a monthly scheduled task that checks the GhostClaw repo for new commits and notifies the user if updates are available.
Setup
Find the main group's chat JID:
sqlite3 store/messages.db "SELECT jid FROM registered_groups WHERE folder = 'main' LIMIT 1;"
Register the task:
CHAT_JID="<main chat JID>"
cat > data/ipc/main/tasks/update_check_$(date +%s).json << EOF
{
"type": "schedule_task",
"prompt": "Check for GhostClaw updates.\n\n1. Run: git fetch origin 2>&1\n2. Run: git log HEAD..origin/main --oneline\n3. If there are new commits, message the user with how many and a one-line summary of each.\n4. If no new commits, respond with <internal>GhostClaw is up to date</internal> and nothing else.\n\nWhen notifying about updates, always include:\n- Number of new commits\n- One-line summary of each\n- Remind them: 'Review the changes with git diff HEAD..origin/main — then run /update-ghostclaw in Claude Code to apply safely (it backs up, migrates, rebuilds, and restarts).'\n- Remind them to review for security — this code runs with full system access.",
"schedule_type": "cron",
"schedule_value": "0 10 * * 1",
"context_mode": "isolated",
"targetJid": "$CHAT_JID"
}
EOF
This runs at 10am on the every Monday.
What the user sees
If updates are available:
3 new GhostClaw commits available:
- abc1234 Add heartbeat disk usage threshold config
- def5678 Fix Telegram reconnection on network change
- ghi9012 Update Grammy to 1.25
Review the changes before applying. This code runs with full system access. Run
git diff HEAD..origin/mainto see the full diff. When ready, run/update-ghostclawin Claude Code to apply safely.
If up to date: silence (wrapped in <internal> tags).
Security note
This skill deliberately does NOT auto-update. The user must:
- Review the diff
- Understand what changed
- Run
/update-ghostclawto apply safely (or apply manually)
GhostClaw runs bare metal with no sandboxing. Blindly pulling code is a security risk.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 8d ago First seen · 58 lines · 33 tokens per session scan A 5d37a1552a27
add-update-check is a skill published in the GitHub repository b1rdmania/ghostclaw (92 stars, last pushed 4mo ago), licensed MIT. It adds 33 tokens to every session and 577 once invoked, about $0.0002 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
lobu-operator
Contribute safely to the Lobu monorepo: worktrees, package rules, red-to-green fixes, validation gates, SDK-first operations, PRs, and rollout checks.
company-agent-infrastructure
Use when designing or building internal/company AI agents that need shared context across company systems, durable organizational memory across sessions or agents, user-scoped permissions, approvals, audit, or governed actions. Also use when deciding whether ordinary MCP tools, RAG, or local agent memory are enough…
lobu-builder
Use when working inside a Lobu project generated by @lobu/cli or any repository centered on lobu.config.ts, AGENTS.md, agent prompt files, local skills, and evals. This skill helps a coding agent inspect the right files, make Lobu-native changes, keep the stack runnable, and validate semantics with chat tests and…
crm-ops
How to operate the Lobu funnel CRM — create and enrich leads, log interactions, advance funnel stages, open and update pilots, and produce the weekly digest. Use whenever the task touches the pipeline.
deliveroo-order
Turn collected lunch orders into a clean per-person order list for a human to place on Deliveroo. Use in step 2 of the lunch run, after orders are collected. The live menu is fetched automatically by the lobu-team-lunch-finalize reaction (via the Owletto Chrome extension) — this skill never places an order or touches…
lobu
Use Lobu MCP for shared, permission-aware company context, durable organizational memory, and governed actions. Trigger when the user asks what the organization knows, needs context from connected company systems, wants to preserve a durable fact or decision, or needs to discover and use Lobu SDK capabilities.