Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add skills/benedictking/ccx/upstream-checknpx skills add BenedictKing/ccx --skill upstream-checkgit clone --depth 1 https://github.com/BenedictKing/ccxWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/benedictking/ccx/upstream-check)<a href="https://agentmods.dev/skills/benedictking/ccx/upstream-check"><img src="https://agentmods.dev/badge/skills/benedictking/ccx/upstream-check.svg" alt="Measured on agentmods" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00036 | $0.01796 |
| Opus 5 | $0.00018 | $0.00898 |
| Sonnet 5 | $0.00007 | $0.00359 |
| Haiku 4.5 | $0.00004 | $0.00180 |
Grade A, and why
upstream-check scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 4d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 157 lines — stays where its author put it; the contents beside it link to each section on GitHub.
上游版本检查技能
当用户输入包含以下关键词时，自动触发上游版本检查流程：
触发条件
- "检查上游版本"、"上游检查"、"检查更新"、"upstream check"、"check upstream"
执行步骤
1. 运行检查脚本
bash .claude/skills/upstream-check/scripts/upstream-check.sh
2. 读取当前状态
cat .claude/skills/upstream-check/scripts/upstream-state.json
3. AI 判断协议变更
重要：脚本的关键词匹配（matched_keywords）仅作为初步筛选，存在误报风险（如 "system clipboard" 误报为 system 协议变更）。
必须通过 AI 二次判断：
- 读取脚本输出的
release_body_snippet（前 800 字符） - 如果
matched_keywords非空，分析每个关键词的上下文：- 是否涉及协议格式变更（如消息结构、字段定义、请求/响应格式）
- 是否涉及新工具/能力引入（如新的 API 端点、工具类型、功能模块）
- 是否涉及核心用法变化（如参数行为调整、默认值改变、废弃警告）
- 排除以下情况的误报：
- Bug 修复中的偶然关键词（如 "system clipboard"、"session's model"）
- UI/UX 改进（如 "environment variables" 在设置说明中）
- 性能优化、日志调整、错误提示改进
- 输出最终判断：
真实协议变更或误报（仅 bug 修复/体验改进）
判断标准：
- ✅ 真实变更：影响 CCX 代理层协议转换、请求构造、响应解析的变更
- ❌ 误报：仅影响 Claude Code/Codex 客户端内部行为，不影响 API 协议的变更
4. 升级建议逻辑
| 条件 | 输出 |
|---|---|
up_to_date: true 且 protocol_changes: false |
"✅ 已是最新版本，无需关注。" |
up_to_date: true 且 protocol_changes: true |
"✅ 版本已是最新。以下版本发布说明涉及协议/工具/用法变更，值得阅读了解：[关键字列表]" |
up_to_date: false 且 protocol_changes: false |
"⬆️ 有新版本 [remote_version] 可用（本地: [local_version]）。非紧急，可在方便时升级。" |
up_to_date: false 且 protocol_changes: true |
"⬆️ 有新版本 [remote_version] 可用（本地: [local_version]），涉及协议/工具/用法变更：[关键字列表]。建议关注并评估对 ccx 的影响。" |
5. 更新 TODO.md
仅当 AI 判断为"真实协议变更"且远程 tag 不在 seen_tags 中时，追加 TODO 条目。
去重检查（必须）：
- 读取
.claude/skills/upstream-check/scripts/upstream-state.json，检查远程 tag 是否已在seen_tags中 - 如已在，跳过 TODO 追加
- 追加后，将 tag 加入
seen_tags（上限 5 条，超出时删除最早的）
TODO.md 更新：
- 检查 TODO.md 是否已有
---分隔线 +> 上游版本变更引用块标题，如无则追加 - 追加格式必须遵循仓库 TODO 规范：每个待办项前面都要有
[ ] - 待办项统一使用
## [ ]二级标题，与 TODO.md 其他条目保持一致 - 分组标识使用分隔线 + 引用块，不使用
##标题，避免与待办项层级冲突 - 推荐追加格式：
---
> **上游版本变更**
## [ ] Claude Code vX.Y.Z 上游协议/工具变更评估
发现协议/工具/用法变更：keyword1, keyword2。请评估对 ccx Messages 渠道的影响。
## [ ] Codex rust-vX.Y.Z 上游协议/工具变更评估
发现协议/工具/用法变更：keyword1, keyword2。请评估对 ccx Responses 渠道的影响。
What ships with it
1 file beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 4d ago First seen · 157 lines · 36 tokens per session scan A acd08a1e47e3
upstream-check is a skill published in the GitHub repository BenedictKing/ccx (3,966 stars, last pushed 3d ago), licensed MIT. It adds 36 tokens to every session and 1,796 once invoked, about $0.0002 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
quality
Evaluates whether a GitHub issue is spam, empty, needs more information, or is OK to proceed.
test-repo
Use this skill to test strategy changes against a fresh test repository. Invoke when the user asks to "test against a test repo", "validate the changes", or wants to verify session hooks, commits, and checkpoint creation work correctly.
development
开发语言能力索引。Python、Go、Rust、TypeScript、Java、C++、Shell。当用户提到编程、开发、代码、语言时路由到此。.
conductor-implement
Executes the tasks defined in the specified track's plan. Use this to start or continue working on a feature, bug fix, or chore.
happier-session-control
Manage Happier sessions (list/status/send/wait/history/stop + execution runs) via the happier CLI JSON contract.
modal
LobeHub imperative modal conventions. Use when creating or migrating modals, dialogs, popups, confirm flows, ModalHost wiring, createModal, confirmModal, useModalContext, or base-ui modal APIs.