Borrowing it
Nothing to install: this file belongs to gaia-react/gaia. Take a copy, put it at the same path in your own repository, and replace the rules that are about this project with yours.
curl -O https://raw.githubusercontent.com/gaia-react/gaia/main/.claude/skills/update-gaia/SKILL.mdgit clone --depth 1 https://github.com/gaia-react/gaiaWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/gaia-react/gaia/update-gaia)<a href="https://agentmods.dev/skills/gaia-react/gaia/update-gaia"><img src="https://agentmods.dev/badge/skills/gaia-react/gaia/update-gaia/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/gaia-react/gaia/update-gaia"><img src="https://agentmods.dev/badge/skills/gaia-react/gaia/update-gaia.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00077 | $0.10963 |
| Opus 5.5 | $0.00031 | $0.04385 |
| Sonnet 5.5 | $0.00015 | $0.02193 |
| Haiku 4.5 | $0.00008 | $0.01096 |
Grade C, and why
update-gaia scanned grade C with 2 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 6d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Recursive force deletehighDestructive command
rm -rf with a variable or a broad path is one typo away from removing the wrong tree.
rm -rf <main checkout path>/.gaia/local/cache/shared/update-gaia/run Makes network callslowCapability
Not a fault in itself. Listed so you know the mod talks to something, and to what.
curl -fsSL https://api.github.com/repos/gaia-react/gaia/releases/latest | jq -r .tag_name How it starts
The opening of the file, as written. The whole thing — 456 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Contents: Pre-flight: Worktree check; Pre-flight: Branch check (run modes); Step 1: Read baseline version; Step 2: Resolve latest release; Step 3: Compare versions (main checkout, worktree run in place); Pre-flight: Pull check (reads references/pull-mode.md); Pre-flight: Decision log check; Pre-flight: Claim check (reads references/claim-flow.md); Step 3b: Refuse a 1.x baseline; Step 3c: Download and verify the bundles; Step 3d: Select migration notes; Step 4: Show the release notes and confirm (on Proceed: the update worktree, the worktree notice, the stop rule, the claim); Step 4b: Prune prior-run artifacts; Conflict flow (reads references/conflict-flow.md: dispatch, questions, decisions, follow-ups); Step 9b: Follow the after-merge notes; Step 9c: Carry new setup features (machine scope deferred to the post-merge cleanup); Step 9d: Record the update; Quality gate; Review point; Step 11 (orchestrator, after the review-point commit); Step 12: The leftover-file cleanup; Cost record (run end).
Pull the latest GAIA release into this project without clobbering customizations. Does a three-way comparison per file (adopter / baseline / latest) and respects explicit classes in .gaia/manifest.json:
owned(GAIA-owned, not the adopter's): GAIA controls fully.shared: GAIA seeds, you customize.wiki-owned(adopter-editable; handled exactly likeshared): GAIA-seeded wiki pages.- adopter-owned (implicit): anything not in the manifest, plus sentinels like
wiki/log.md,CHANGELOG.md,.gaia/VERSION,.gaia/manifest.json,.gaia/update-decisions.json. The merge walk never touches them; Step 9d rewrites.gaia/manifest.jsonand.gaia/VERSIONonce the merge is done, and the decision steps below write.gaia/update-decisions.json.
The first three take the same Step 7 rows. The class changes only two of them: which status a clean overwrite reports (owned → overwrite, the other two → merge), and what happens when the release newly owns a path the adopter already has (owned backs up and overwrites, the other two fall through to the ordinary rows). Step 7 is authoritative.
Backups land in .gaia-backup/<timestamp>/ in the acting tree, the update worktree. The merge report, its candidate files and the instruction snapshot land in the run directory, <main checkout path>/.gaia/local/cache/shared/update-gaia/run (gitignored, written only through Bash), which the run removes after Step 11.
Who runs what. This file runs the pre-flight through Step 4b, then dispatches the execution agent for Steps 6 to 9 (references/merge-execution.md), which merges and writes a JSON report but asks nothing. Every step after that runs here, in the orchestrator: the questions, applying the answers and recording the decisions, the follow-ups, Steps 9b to 9d, the quality gate, the review point with its single commit confirm, and Steps 11 and 12. Everything from Step 4b on runs inside the update worktree, so the main checkout's branch, files and node_modules stay as the user left them, whichever branch it holds. Every orchestrator step lives in this file or in references/conflict-flow.md, which the orchestrator reads in full before the dispatch, because the merge walk can overwrite this skill's own files partway through the run and the orchestrator keeps following the copy it already read. The draft PR's merge and cleanup run later, through the PR Merge Workflow.
Every command block below is one plain command with each value typed as a literal (written <NAME>), or a call to a tracked script by its literal path: inside a worktree session the runtime refuses a captured command substitution, a shell variable in a path, and a heredoc.
Pre-flight: Worktree check
This wrapper changes .gaia/VERSION and opens a PR, which belong to the main checkout (the clone's primary working directory, on any branch) or to this command's own update worktree, never to a SPEC, debt or feature worktree or to /update-deps's deps/ worktree. Invoked from any other linked worktree, it refuses hard with a message that surfaces the cached version state from main, so the user knows whether a GAIA update is even pending. The "update/" argument admits a worktree on an update/ branch, so a re-run inside this command's own update worktree continues there.
What ships with it
7 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 6d ago Changed · +9 lines c01ba8430490
- 8d ago Changed · +15 lines 03133bb6565b
- 9d ago Changed · +6 lines e0e2480629a8
- 10d ago Changed · -2 lines 19e4f9563335
- 11d ago Changed · +60 lines · +1 tokens per session scan B → C 024b06b9634e
- 12d ago Changed · -97 lines scan D → B 289155a40aff
- 13d ago Changed 29437de473b9
- 14d ago Changed · +2 lines 604e8d5e941d
- 16d ago Changed · +234 lines scan C → D ccd2ea80d872
- 17d ago First seen · 229 lines · 76 tokens per session scan C 31e313d94227
update-gaia is a skill published in the GitHub repository gaia-react/gaia (26 stars, last pushed 4d ago), licensed MIT. It adds 77 tokens to every session and 10,963 once invoked, about $0.0003 per session on Opus 5.5. A static security scan graded it C with 2 findings (recursive force delete, makes network calls). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
git
A guide to common Git version-control workflows. Git records changes to code so developers can work in branches, combine changes, and review project history.
github
A guide to using GitHub CLI, a command-line tool for working with GitHub repositories. It covers issues, pull requests, releases, labels, milestones, and workflow runs.
commit-work
Create high-quality git commits: review/stage intended changes, split into logical commits, and write clear commit messages (including Conventional Commits). Use when the user asks to commit, craft a commit message, stage changes, or split work into multiple commits.
compiler-commit
Use when you want to verify compiler changes and commit with the correct convention. Runs tests, lint, and format, then commits with the [compiler] or [rust-compiler] prefix.
merge-seed
Merge upstream React Starter Kit updates (the seed remote) into main, preserving this project's identity, scope, and behavior. Use when asked to sync, pull, or merge the seed / starter kit / upstream template.
release-safety
Release safety rules. INVOKE WHEN: yarn release, npm publish, release canary, release packages, publishing, skip checks, skip tests. NEVER skip checks or tests without explicit permission.