agentmods.dev

update-agent-foundation

update-agent-foundation is a skill for Codex from DongLiStudio/personal-agent-foundation. It costs 87 tokens per session (1,256 once invoked), scanned A, original, Apache-2.0.

A procedure for safely updating an already installed Personal Agent Foundation, a set of shared agent rules and tools. It compares trusted upstream versions, protects user-specific settings, and supports review, backup, and rollback.

In plain words
What is it for?
It helps check for updates, plan and apply changes from the trusted source, preserve custom files, and verify or undo the update if needed.
Why use it?
It reduces the risk of overwriting projects, credentials, personal rules, or other local settings during an update. It also separates product updates from first-time installation and recovery.

Skill for Codex

Written for Codex: agents/openai.yaml present.

not rated 16repo +3 changed 15d ago A scan 87 tokens original Apache-2.0

Good fit It helps check for updates, plan and apply changes from the trusted source, preserve custom files, and verify or undo the update if needed.

Compare 6 skills from other repositories ↓
Install with agentmods
npx agentmods add skills/donglistudio/personal-agent-foundation/update-agent-foundation
View source ↗ DongLiStudio/personal-agent-foundation
Install

Getting it into your agent

One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.

Any agent
npx skills add DongLiStudio/personal-agent-foundation --skill update-agent-foundation
Clone the repo
git clone --depth 1 https://github.com/DongLiStudio/personal-agent-foundation

Made for: Codex.

Wrote this? Show the measurements

A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.

agentmods badge for update-agent-foundation

README.md
[![agentmods](https://agentmods.dev/badge/skills/donglistudio/personal-agent-foundation/update-agent-foundation/github.svg)](https://agentmods.dev/skills/donglistudio/personal-agent-foundation/update-agent-foundation)
Your own site
<a href="https://agentmods.dev/skills/donglistudio/personal-agent-foundation/update-agent-foundation"><img src="https://agentmods.dev/badge/skills/donglistudio/personal-agent-foundation/update-agent-foundation/github.svg" alt="Measured on agentmods" height="20"></a>

Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.

agentmods 80×15 button for update-agent-foundation

Your own site · 80×15
<a href="https://agentmods.dev/skills/donglistudio/personal-agent-foundation/update-agent-foundation"><img src="https://agentmods.dev/badge/skills/donglistudio/personal-agent-foundation/update-agent-foundation.svg" alt="Reviewed on agentmods" width="80" height="20"></a>
Per session 87 Skills are progressive disclosure: only the name and description are preloaded; the body loads when the skill is used.
When invoked 1,256 The whole file, excluding the scripts and references it only reads on demand.
Security scan A 0 findings. A grade says what 26 rules found in the file — not that it is safe.
Origin original No closer match found in the catalogue.
Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

ModelPer sessionOnce invoked
Fable 5.1 $0.00087 $0.01256
Opus 5.5 $0.00035 $0.00502
Sonnet 5.5 $0.00017 $0.00251
Haiku 4.5 $0.00009 $0.00126

Measured 15d ago against content hash 5db8693b0a09, method: parsed. Prices are Anthropic first-party input rates as of 2026-10-07, from the pricing page.

Security

Grade A, and why

update-agent-foundation scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 15d ago.

The scan reads SKILL.md. This mod also ships 2 executable files (scripts/foundation_update.py, scripts/test_foundation_update.py), listed below but not scanned — reading those needs a real analyzer, not pattern matching.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Nothing flagged

None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.

skills/update-agent-foundation/SKILL.md · 56 lines

How it starts

The opening of the file, as written. The whole thing — 56 lines — stays where its author put it; the contents beside it link to each section on GitHub.

更新 Personal Agent Foundation

把本 Skill 作为已有基座的唯一版本更新入口。首次安装使用 install-agent-scaffold；换机、迁移、损坏修复使用 restore-agent-foundation；只有从可信产品上游引入新版时使用本 Skill。

开始前

完整读取 更新契约。更新脚本只负责确定性盘点、计划、受管 Skill/新增文件更新、备份、验证和回滚；GLOBAL 治理文本的语义合并由当前 Agent 在展示差异并取得确认后完成。

优先使用官方仓库 https://github.com/DongLiStudio/personal-agent-foundation.git。把指定 tag、commit 或默认分支克隆到系统临时目录，不在 Agent 根或 GLOBAL 内长期保存产品源码。记录实际 commit；不得把未经确认的 fork、工作树或网页片段当作更新源。

固定保护边界

  • 不覆盖、删除或重建用户项目、项目 Git、未提交内容、外部知识库或链接目标。
  • PROJECTS.md、LARK_PROFILES.md、GITHUB_ACCOUNTS.md、GITEE_PROFILES.md、ALIYUN_PROFILES.md、TENCENTCLOUD_PROFILES.md、MAIL_PROFILES.md、WECHAT_PROFILES.md、SERVER_PROFILES.md、servers/、OBSIDIAN_LINK.md、SCHEDULE_PREFERENCES.md 和 FOUNDATION_STATE.json 始终视为用户状态，只做语义补充，不用公开模板替换。
  • GLOBAL/.agents/skills/ 中与上游同名的产品自维护 Skill 属于受管程序文件，可以在计划确认后逐文件更新；用户额外创建的 Skill 不删除。
  • README.md、GLOBAL_CONTEXT.md、SKILL_DEPENDENCIES.md、.gitignore 等治理文件发生变化时进入人工可读的语义合并清单，保留用户个性化规则与真实路由。
  • 不接受模板残留占位符，不跟随 Junction、symlink 或 reparse point，不把 token、PAT、AK/SK、密码、私钥或 Cookie 写入计划、备份说明或报告。
  • 更新授权不等于远程仓库创建、MR 合并、Release、部署、账号授权或服务器变更授权。

更新流程

  1. 读取 Agent 根下 GLOBAL/README.md、GLOBAL_CONTEXT.md、FOUNDATION_STATE.json，以及所有活跃项目三入口；记录各 Git 工作树，不要求其干净，也不改项目业务文件。
  2. 获取可信产品源，执行产品仓库自身的模板审计；审计失败立即停止。
  3. 使用脚本 audit 比较当前实例与新版模板，输出新增文件、受管 Skill 更新、用户状态保护项和治理语义合并项。
  4. 使用 plan 生成带 plan_sha256 的计划。逐项向用户展示：来源 commit、会写入什么、会保留什么、需要语义合并什么、备份与回滚位置。
  5. 用户确认当前计划后执行 apply；计划或文件变化后必须重新生成，不能沿用旧确认。
  6. 对计划中的 review_merge 文件逐个做最小语义合并。不得复制公开模板覆盖整份真实 GLOBAL 文件；先保留用户内容，再补入新版规则。
  7. 运行 verify，再调用 restore-agent-foundation verify 检查路径、Skill 安装副本、链接、宿主与授权门禁。
  8. 按当前 GLOBAL Git 规则对 GLOBAL 和确有变更的项目分别检查、提交、push 并回读；产品源码临时目录不提交到用户基座。
<python> scripts/foundation_update.py audit --root <agent-root> --source <product-repo> --report <temp-audit.json>
<python> scripts/foundation_update.py plan --root <agent-root> --source <product-repo> --report <temp-plan.json>
<python> scripts/foundation_update.py apply --plan <temp-plan.json> --confirm-plan-sha256 <sha256>
<python> scripts/foundation_update.py verify --root <agent-root> --source <product-repo>

Read the full file on GitHub · 56 lines

Files

What ships with it

4 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

  1. 15d ago Changed 5db8693b0a09
  2. 1mo ago First seen · 56 lines · 87 tokens per session scan A dc761b84a937

Subscribe to this mod's changes

update-agent-foundation is a skill published in the GitHub repository DongLiStudio/personal-agent-foundation (16 stars, last pushed yesterday), licensed Apache-2.0. It adds 87 tokens to every session and 1,256 once invoked, about $0.0003 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-09-14.

Building agentstools
Related

Other skills, from other repositories

harbor-daytona

Use Harbor's Daytona sandbox platform for computer use — creating sandboxes, taking screenshots, sending mouse/keyboard input, and building agent loops. Use when the user wants to interact with a GUI, automate a desktop, do computer use, control a browser visually, or run Claude computer use against a Daytona sandbox.

av/harbor · 67 tokens

boost-modules

Skill "boost-modules" from av/harbor, covering harbor boost custom modules, module structure, quick reference, output methods and stream text to client.

av/harbor · 0 tokens

token-usage

Nested swiss-knife reference for token usage, cost, cache, and tool-call/API-call reports. Use for model cost reports, cache rates, budget/burn analysis, and tools-per-API-call trends across LingTai logs.

Lingtai-AI/lingtai · 50 tokens

composio

Build AI agents and apps with Composio - access 200+ external tools with Tool Router or direct execution.

aAAaqwq/AGI-Super-Team · 26 tokens

security-arsenal

Security payloads, bypass tables, wordlists, gf pattern names, always-rejected bug list, and conditionally-valid-with-chain table. Use when you need specific payloads for XSS/SSRF/SQLi/XXE/NoSQLi/command injection/SSTI/IDOR/path-traversal/HTTP smuggling/WebSocket/MFA bypass, bypass techniques, or to check if a finding…

uphiago/recon-skills · 103 tokens

frontmcp-development

Use when building any FrontMCP server component other than a tool (for tools, use create-tool). Covers @Resource static resources and parameterized URI templates; @Prompt reusable prompts (RAG, multi-turn); @Provider singleton dependency-injection providers (database pools, API clients); @Agent autonomous LLM agents…

agentfront/frontmcp · 196 tokens