What is upstream-check?

A tool for checking whether local Claude Code or Codex components differ from their upstream versions, meaning the versions maintained by the original project.

Use it to check versions, review release notes, decide whether a change affects protocols or tool usage, and record follow-up TODOs.

It helps identify updates that may change message formats, tools, or normal usage, while filtering out unrelated release-note matches.

How BenedictKing/ccx configures Claude Code

About the project

BenedictKing/ccx is an AI API proxy and protocol-translation gateway that provides one entry point for Claude, OpenAI, Codex Responses, Gemini, and other listed APIs. It is used to manage provider channels, keys, routing, monitoring, and failover, and the catalogue entries provide skills and instructions for operating it.

BenedictKing/ccx · 3,983 stars · on GitHub · benedictking.github.io

Reuse

Borrowing it

Nothing to install: this file belongs to BenedictKing/ccx. Take a copy, put it at the same path in your own repository, and replace the rules that are about this project with yours.

Copy the file

curl -O https://raw.githubusercontent.com/BenedictKing/ccx/main/.claude/skills/upstream-check/SKILL.md

Clone the repo

git clone --depth 1 https://github.com/BenedictKing/ccx

Made for: Claude Code.

Wrote this? Show the measurements

A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.

README.md

[![agentmods](https://agentmods.dev/badge/skills/benedictking/ccx/upstream-check/github.svg)](https://agentmods.dev/skills/benedictking/ccx/upstream-check)

Your own site

<a href="https://agentmods.dev/skills/benedictking/ccx/upstream-check"><img src="https://agentmods.dev/badge/skills/benedictking/ccx/upstream-check/github.svg" alt="Measured on agentmods" height="20"></a>

Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.

Your own site · 80×15

<a href="https://agentmods.dev/skills/benedictking/ccx/upstream-check"><img src="https://agentmods.dev/badge/skills/benedictking/ccx/upstream-check.svg" alt="Reviewed on agentmods" width="80" height="20"></a>

Per session 36 Skills are progressive disclosure: only the name and description are preloaded; the body loads when the skill is used.

When invoked 1,792 The whole file, excluding the scripts and references it only reads on demand.

Security scan A 0 findings. A grade says what 26 rules found in the file — not that it is safe. Third-party audits

NVIDIA SkillSpector warn 7 Sept 2026

SkillSpector: 1 finding, up to high

These are SkillSpector’s own severities. On a checked sample its high-severity flags on skills were ~96% false positives — a documented command, a public API, a “never do X” rule — so we show them as a caution to read, not a verdict. Why →

high Agent Snooping · line 29
Skill reads from agent configuration directories (.claude/, .codex/, .gemini/). These directories may contain API keys, personal settings, and other credentials that the skill has no legitimate need to access.

Fix: Remove all code or instructions that access agent configuration directories (.claude/, .codex/, .gemini/). If configuration values are needed, pass them explicitly as parameters or environment variabl

How audits are shown

Origin original No closer match found in the catalogue.

Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

Model	Per session	Once invoked
Fable 5.1	$0.00036	$0.01792
Opus 5.5	$0.00014	$0.00717
Sonnet 5.5	$0.00007	$0.00358
Haiku 4.5	$0.00004	$0.00179

Measured 1mo ago against content hash f4a717e704a7, method: parsed. Prices are Anthropic first-party input rates as of 2026-10-07, from the pricing page.

Security

Grade A, and why

upstream-check scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 1mo ago.

The scan reads SKILL.md. This mod also ships 1 executable file (scripts/upstream-check.sh), listed below but not scanned — reading those needs a real analyzer, not pattern matching.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Nothing flagged

None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.

.claude/skills/upstream-check/SKILL.md · 156 lines

How it starts

The opening of the file, as written. The whole thing — 156 lines — stays where its author put it; the contents beside it link to each section on GitHub.

上游版本检查技能

当用户输入包含以下关键词时，自动触发上游版本检查流程：

触发条件

"检查上游版本"、"上游检查"、"检查更新"、"upstream check"、"check upstream"

执行步骤

1. 运行检查脚本

bash .claude/skills/upstream-check/scripts/upstream-check.sh

2. 读取当前状态

cat .claude/skills/upstream-check/scripts/upstream-state.json

3. AI 判断协议变更

重要：脚本的关键词匹配（matched_keywords）仅作为初步筛选，存在误报风险（如 "system clipboard" 误报为 system 协议变更）。

必须通过 AI 二次判断：

读取脚本输出的 release_body_snippet（前 800 字符）
如果 matched_keywords 非空，分析每个关键词的上下文：
- 是否涉及协议格式变更（如消息结构、字段定义、请求/响应格式）
- 是否涉及新工具/能力引入（如新的 API 端点、工具类型、功能模块）
- 是否涉及核心用法变化（如参数行为调整、默认值改变、废弃警告）
排除以下情况的误报：
- Bug 修复中的偶然关键词（如 "system clipboard"、"session's model"）
- UI/UX 改进（如 "environment variables" 在设置说明中）
- 性能优化、日志调整、错误提示改进
输出最终判断：真实协议变更 或 误报（仅 bug 修复/体验改进）

判断标准：

✅ 真实变更：影响 CCX 代理层协议转换、请求构造、响应解析的变更
❌ 误报：仅影响 Claude Code/Codex 客户端内部行为，不影响 API 协议的变更

4. 升级建议逻辑

条件	输出
`up_to_date: true` 且 `protocol_changes: false`	"✅ 已是最新版本，无需关注。"
`up_to_date: true` 且 `protocol_changes: true`	"✅ 版本已是最新。以下版本发布说明涉及协议/工具/用法变更，值得阅读了解：[关键字列表]"
`up_to_date: false` 且 `protocol_changes: false`	"⬆️ 有新版本 [remote_version] 可用（本地: [local_version]）。非紧急，可在方便时升级。"
`up_to_date: false` 且 `protocol_changes: true`	"⬆️ 有新版本 [remote_version] 可用（本地: [local_version]），涉及协议/工具/用法变更：[关键字列表]。建议关注并评估对 ccx 的影响。"

5. 更新 TODO.md

仅当 AI 判断为"真实协议变更"且远程 tag 不在 seen_tags 中时，追加 TODO 条目。

去重检查（必须）：

读取 .claude/skills/upstream-check/scripts/upstream-state.json，检查远程 tag 是否已在 seen_tags 中
如已在，跳过 TODO 追加
追加后，将 tag 加入 seen_tags（上限 5 条，超出时删除最早的）

TODO.md 更新：

检查 TODO.md 是否已有 --- 分隔线 + > 上游版本变更 引用块标题，如无则追加
追加格式必须遵循仓库 TODO 规范：每个待办项前面都要有 [ ]
待办项统一使用 ## [ ] 二级标题，与 TODO.md 其他条目保持一致
分组标识使用分隔线 + 引用块，不使用 ## 标题，避免与待办项层级冲突
推荐追加格式：

---

> **上游版本变更**

## [ ] Claude Code vX.Y.Z 上游协议/工具变更评估

发现协议/工具/用法变更：keyword1, keyword2。请评估对 ccx Messages 渠道的影响。

## [ ] Codex rust-vX.Y.Z 上游协议/工具变更评估

发现协议/工具/用法变更：keyword1, keyword2。请评估对 ccx Responses 渠道的影响。

Read the full file on GitHub · 156 lines

Files

What ships with it

1 file beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.

scripts/upstream-check.sh 4.7 KB runs code

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

1mo ago Changed · -1 lines f4a717e704a7
2mo ago First seen · 157 lines · 36 tokens per session scan A acd08a1e47e3

Subscribe to this mod's changes

upstream-check is a skill published in the GitHub repository BenedictKing/ccx (3,983 stars, last pushed 3d ago), licensed MIT. It adds 36 tokens to every session and 1,792 once invoked, about $0.0001 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.

Building agents claude codex gemini

upstream-check next to 6 skills from other repositories
Mod	Type	Stars	Last push	Licence	Scan	Tokens	Works with
upstream-checkBenedictKing/ccx	Skill	4.0k	3d ago	MIT	A	36	Claude Code
developmentfengshao1227/ccg-workflow	Skill	6.0k	4d ago	MIT	A	41	Claude Code
bionic-decision-enginewinstonkoh87/Athena-Public	Skill	620	yesterday	MIT	A	41	Claude Code, Codex
trading-risk-gatewinstonkoh87/Athena-Public	Skill	620	yesterday	MIT	A	53	Claude Code
macos-toolssonichi/sutando	Skill	404	today	MIT	A	52	Claude Code, Codex
cmux-architecturemanaflow-ai/cmux	Skill	29k	today	none	A	63	Codex
video-perceptionjordanrendric/claude-video-vision	Skill	1.5k	23d ago	MIT	A	51	Claude Code

ccx: Skill for Claude Code