gaia: Skill for Claude Code

.claude/skills/update-gaia/SKILL.md

update-gaia is a skill for Claude Code from gaia-react/gaia. It costs 77 tokens per session (10,963 once invoked), scanned C, original, MIT.

A controlled updater for GAIA project files that compares the version you adopted, your current files, and the newest release. It classifies files so customized project content is treated differently from GAIA-managed content.

In plain words
What is it for?
Use it when pulling a newer GAIA release into a project, reviewing file changes, handling conflicts, and updating the project on the main checkout.
Why use it?
It helps bring in new GAIA changes while reducing the chance of overwriting local customizations, and records backups or merge conflicts when needed.

Skill for Claude Code

Written for Claude Code: SessionStart hook event. Also seen: reads .claude/ paths; names the AskUserQuestion tool.

This is gaia-react/gaia's own configuration. It tells Claude Code how to work on gaia itself, so it is not a mod to install elsewhere. Copy it as a starting point and replace the rules that are about this project. Everything gaia configures →

Needs its repository: it runs a file that does not travel with it, so clone the repository first. The line is bash .gaia/scripts/update-gaia-branch-state.sh classify --tag <LATEST_TAG> --latest <LATEST>.

Reuse

Borrowing it

Nothing to install: this file belongs to gaia-react/gaia. Take a copy, put it at the same path in your own repository, and replace the rules that are about this project with yours.

Copy the file
curl -O https://raw.githubusercontent.com/gaia-react/gaia/main/.claude/skills/update-gaia/SKILL.md
Clone the repo
git clone --depth 1 https://github.com/gaia-react/gaia

Made for: Claude Code.

Wrote this? Show the measurements

A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.

agentmods badge for update-gaia

README.md
[![agentmods](https://agentmods.dev/badge/skills/gaia-react/gaia/update-gaia/github.svg)](https://agentmods.dev/skills/gaia-react/gaia/update-gaia)
Your own site
<a href="https://agentmods.dev/skills/gaia-react/gaia/update-gaia"><img src="https://agentmods.dev/badge/skills/gaia-react/gaia/update-gaia/github.svg" alt="Measured on agentmods" height="20"></a>

Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.

agentmods 80×15 button for update-gaia

Your own site · 80×15
<a href="https://agentmods.dev/skills/gaia-react/gaia/update-gaia"><img src="https://agentmods.dev/badge/skills/gaia-react/gaia/update-gaia.svg" alt="Reviewed on agentmods" width="80" height="20"></a>
Per session 77 Skills are progressive disclosure: only the name and description are preloaded; the body loads when the skill is used.
When invoked 10,963 The whole file, excluding the scripts and references it only reads on demand.
Security scan C 2 findings. A grade says what 26 rules found in the file — not that it is safe.
Origin original No closer match found in the catalogue.
Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

ModelPer sessionOnce invoked
Fable 5.1 $0.00077 $0.10963
Opus 5.5 $0.00031 $0.04385
Sonnet 5.5 $0.00015 $0.02193
Haiku 4.5 $0.00008 $0.01096

Measured 6d ago against content hash c01ba8430490, method: parsed. Prices are Anthropic first-party input rates as of 2026-10-07, from the pricing page.

Security

Grade C, and why

update-gaia scanned grade C with 2 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 6d ago.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Recursive force deletehighDestructive command

rm -rf with a variable or a broad path is one typo away from removing the wrong tree.

rm -rf <main checkout path>/.gaia/local/cache/shared/update-gaia/run

Makes network callslowCapability

Not a fault in itself. Listed so you know the mod talks to something, and to what.

curl -fsSL https://api.github.com/repos/gaia-react/gaia/releases/latest | jq -r .tag_name
.claude/skills/update-gaia/SKILL.md · 456 lines

How it starts

The opening of the file, as written. The whole thing — 456 lines — stays where its author put it; the contents beside it link to each section on GitHub.

Contents: Pre-flight: Worktree check; Pre-flight: Branch check (run modes); Step 1: Read baseline version; Step 2: Resolve latest release; Step 3: Compare versions (main checkout, worktree run in place); Pre-flight: Pull check (reads references/pull-mode.md); Pre-flight: Decision log check; Pre-flight: Claim check (reads references/claim-flow.md); Step 3b: Refuse a 1.x baseline; Step 3c: Download and verify the bundles; Step 3d: Select migration notes; Step 4: Show the release notes and confirm (on Proceed: the update worktree, the worktree notice, the stop rule, the claim); Step 4b: Prune prior-run artifacts; Conflict flow (reads references/conflict-flow.md: dispatch, questions, decisions, follow-ups); Step 9b: Follow the after-merge notes; Step 9c: Carry new setup features (machine scope deferred to the post-merge cleanup); Step 9d: Record the update; Quality gate; Review point; Step 11 (orchestrator, after the review-point commit); Step 12: The leftover-file cleanup; Cost record (run end).

Pull the latest GAIA release into this project without clobbering customizations. Does a three-way comparison per file (adopter / baseline / latest) and respects explicit classes in .gaia/manifest.json:

  • owned (GAIA-owned, not the adopter's): GAIA controls fully.
  • shared: GAIA seeds, you customize.
  • wiki-owned (adopter-editable; handled exactly like shared): GAIA-seeded wiki pages.
  • adopter-owned (implicit): anything not in the manifest, plus sentinels like wiki/log.md, CHANGELOG.md, .gaia/VERSION, .gaia/manifest.json, .gaia/update-decisions.json. The merge walk never touches them; Step 9d rewrites .gaia/manifest.json and .gaia/VERSION once the merge is done, and the decision steps below write .gaia/update-decisions.json.

The first three take the same Step 7 rows. The class changes only two of them: which status a clean overwrite reports (owned → overwrite, the other two → merge), and what happens when the release newly owns a path the adopter already has (owned backs up and overwrites, the other two fall through to the ordinary rows). Step 7 is authoritative.

Backups land in .gaia-backup/<timestamp>/ in the acting tree, the update worktree. The merge report, its candidate files and the instruction snapshot land in the run directory, <main checkout path>/.gaia/local/cache/shared/update-gaia/run (gitignored, written only through Bash), which the run removes after Step 11.

Who runs what. This file runs the pre-flight through Step 4b, then dispatches the execution agent for Steps 6 to 9 (references/merge-execution.md), which merges and writes a JSON report but asks nothing. Every step after that runs here, in the orchestrator: the questions, applying the answers and recording the decisions, the follow-ups, Steps 9b to 9d, the quality gate, the review point with its single commit confirm, and Steps 11 and 12. Everything from Step 4b on runs inside the update worktree, so the main checkout's branch, files and node_modules stay as the user left them, whichever branch it holds. Every orchestrator step lives in this file or in references/conflict-flow.md, which the orchestrator reads in full before the dispatch, because the merge walk can overwrite this skill's own files partway through the run and the orchestrator keeps following the copy it already read. The draft PR's merge and cleanup run later, through the PR Merge Workflow.

Every command block below is one plain command with each value typed as a literal (written <NAME>), or a call to a tracked script by its literal path: inside a worktree session the runtime refuses a captured command substitution, a shell variable in a path, and a heredoc.

Pre-flight: Worktree check

This wrapper changes .gaia/VERSION and opens a PR, which belong to the main checkout (the clone's primary working directory, on any branch) or to this command's own update worktree, never to a SPEC, debt or feature worktree or to /update-deps's deps/ worktree. Invoked from any other linked worktree, it refuses hard with a message that surfaces the cached version state from main, so the user knows whether a GAIA update is even pending. The "update/" argument admits a worktree on an update/ branch, so a re-run inside this command's own update worktree continues there.

Read the full file on GitHub · 456 lines

Files

What ships with it

7 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

  1. 6d ago Changed · +9 lines c01ba8430490
  2. 8d ago Changed · +15 lines 03133bb6565b
  3. 9d ago Changed · +6 lines e0e2480629a8
  4. 10d ago Changed · -2 lines 19e4f9563335
  5. 11d ago Changed · +60 lines · +1 tokens per session scan B → C 024b06b9634e
  6. 12d ago Changed · -97 lines scan D → B 289155a40aff
  7. 13d ago Changed 29437de473b9
  8. 14d ago Changed · +2 lines 604e8d5e941d
  9. 16d ago Changed · +234 lines scan C → D ccd2ea80d872
  10. 17d ago First seen · 229 lines · 76 tokens per session scan C 31e313d94227

Subscribe to this mod's changes

update-gaia is a skill published in the GitHub repository gaia-react/gaia (26 stars, last pushed 4d ago), licensed MIT. It adds 77 tokens to every session and 10,963 once invoked, about $0.0003 per session on Opus 5.5. A static security scan graded it C with 2 findings (recursive force delete, makes network calls). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.