Borrowing it
Nothing to install: this file belongs to geekfujiwara/CodeAppsDevelopmentStandard. Take a copy, put it at the same path in your own repository, and replace the rules that are about this project with yours.
curl -O https://raw.githubusercontent.com/geekfujiwara/CodeAppsDevelopmentStandard/main/.github/skills/update-skills/SKILL.mdgit clone --depth 1 https://github.com/geekfujiwara/CodeAppsDevelopmentStandardWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/geekfujiwara/codeappsdevelopmentstandard/update-skills)<a href="https://agentmods.dev/skills/geekfujiwara/codeappsdevelopmentstandard/update-skills"><img src="https://agentmods.dev/badge/skills/geekfujiwara/codeappsdevelopmentstandard/update-skills/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/geekfujiwara/codeappsdevelopmentstandard/update-skills"><img src="https://agentmods.dev/badge/skills/geekfujiwara/codeappsdevelopmentstandard/update-skills.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector warn
SkillSpector: 3 findings, up to high
These are SkillSpector’s own severities. On a checked sample its high-severity flags on skills were ~96% false positives — a documented command, a public API, a “never do X” rule — so we show them as a caution to read, not a verdict. Why →
- high Rogue Agent · line 12 Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.Fix: Prevent the skill from modifying its own code, SKILL.md, or configuration files. Treat skill files as read-only at runtime.
- high Privilege Escalation · line 103 Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.Fix: Remove references to credential paths. Use environment variables or secrets managers. For docs, use placeholder paths (e.g., /path/to/config). Never load .env or token files in production code paths.
- high Privilege Escalation · line 166 Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.Fix: Remove references to credential paths. Use environment variables or secrets managers. For docs, use placeholder paths (e.g., /path/to/config). Never load .env or token files in production code paths.
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00255 | $0.06253 |
| Opus 5.5 | $0.00102 | $0.02501 |
| Sonnet 5.5 | $0.00051 | $0.01251 |
| Haiku 4.5 | $0.00026 | $0.00625 |
Grade A, and why
update-skills scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 10d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 279 lines — stays where its author put it; the contents beside it link to each section on GitHub.
スキル作成・更新 & PR 作成スキル
スキル（SKILL.md + references/ + scripts/）を新規作成または更新し、
リモートリポジトリへ PR を作成・更新するまでを一貫して行う。
サンプル（code-apps/samples/）の追加・更新時は sample-packaging.md のチェックも実施する。
このスキル自身が「良いスキルの形」のテンプレートになっている。守るべき原則は以下の 6 つ。
| 原則 | 内容 |
|---|---|
| 役割分離 | SKILL.md = 正常系のみ。参考情報・異常系は references/、利用スクリプトは scripts/ |
| 汎用化 | テナント・組織・テーマに依存しない。パラメータは references/.env.example に定義し、実値は .env から読む |
| 秘匿化 | 会社名・個別プロジェクト名・実 GUID・URL・メール・シークレットを排除（→ Step 4 のスキャン） |
| シンプル | 本文は短く。冗長な説明は references/ に逃がす。手順の番号は整数の Step で統一 |
| 自動化優先 | 公式仕様は Microsoft Learn MCP で検証、ブラウザ操作は VS Code 統合ブラウザで自動化（→ Step 5） |
| 再発防止 | 作業中にバグ・落とし穴を見つけて直したら references/troubleshooting.md への記録だけで終わらせず、同じ入力パターンで二度と起きないよう scripts/ 本体に恒久的な事前チェック（アサーション/事前検証）を追加し、正常系（成功する実行）でも毎回そのチェックが動く状態にする（→ Step 1 の 6） |
前提ツール: Git、GitHub CLI（
gh、認証済み）、Python 3。 異常系・詰まりどころは references/troubleshooting.md、 テンプレート同梱とスキャフォールドは references/scaffolding.md、 PR の更新/新規判断とマージ順は references/pr-strategy.md、 ポータル操作の private API 化は references/private-api-automation.md を参照。
スキル同梱スクリプト（再利用）
scripts/ は汎用化済み。値は引数または .env（references/.env.example 参照）から取得する。
| スクリプト | 用途 |
|---|---|
| scripts/validate_skill.py | 構成検証: フォルダ名＝name 一致 / Step 番号が整数連番 / references・scripts の有無 / テンプレート変数の宣言 / 秘匿情報スキャン（Step 4・8） |
| scripts/scaffold_from_template.py | 汎用スキャフォルダー: templates/ から作業ツリーを生成。${VAR}/__VAR__ 置換、機能ブロック、未解決変数で停止。バイナリ（GLB・HDR 等）は中身で判定してそのままコピー（Step 3） |
| scripts/scan_sample.py | Code Apps サンプルの公開前検証: 実値・秘匿情報・テーブル名直書き・.gitignore を検査（Step 1） |
| scripts/manage_skill_pr.py | リモートのオープン PR を走査し、対象スキルに触れる PR を検出して「更新 or 新規」とマージ順を提示（Step 6） |
| scripts/publish_skill.py | 公開を一括自動化: PR 先リポジトリを一時 clone → ブランチ → スキル＋集約ファイルをコピー → 検証 → commit → push → PR 作成/更新（Step 7）。スキル統合時は --remove で旧フォルダを削除。--dry-run 対応。--remove 以外の削除とビルド出力の追加、templates/ の入口（引数・事前チェック）の削除はコミット前に止める（--allow-delete / --allow-build-output / --allow-entrypoint-change で解除） |
What ships with it
15 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
- references/.env.example 897 B
- references/pr-strategy.md 2.8 KB
- references/private-api-automation.md 4.1 KB
- references/sample-packaging.md 11 KB
- references/scaffolding.md 11 KB
- references/troubleshooting.md 25 KB
- scripts/manage_skill_pr.py 5.8 KB runs code
- scripts/publish_skill.py 20 KB runs code
- scripts/scaffold_from_template.py 20 KB runs code
- scripts/scan_sample.py 6.5 KB runs code
- scripts/test_scaffold_questions.py 4.9 KB runs code
- scripts/validate_skill.py 20 KB runs code
- tests/test_publish_skill.py 2.5 KB runs code
- tests/test_scaffold_from_template.py 7.1 KB runs code
- tests/test_validate_skill.py 6.1 KB runs code
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 10d ago Changed · +3 lines b740488bb9d9
- 28d ago Changed e3bb24324cdb
- 1mo ago Changed 5bfecc0b1bea
- 1mo ago Changed a874e73af5cc
- 1mo ago Changed · +2 lines d7e1f08dcb91
- 1mo ago Changed · +6 lines 7428fd57793f
- 1mo ago Changed · +37 lines · +53 tokens per session 8d5683d89cba
- 1mo ago Changed · +9 lines d5ac850cc7fb
- 1mo ago Changed · +7 lines d425238a4fd4
- 1mo ago First seen · 215 lines · 202 tokens per session scan A 0281c7702cb0
update-skills is a skill published in the GitHub repository geekfujiwara/CodeAppsDevelopmentStandard (78 stars, last pushed yesterday), licensed MIT. It adds 255 tokens to every session and 6,253 once invoked, about $0.0010 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
update-skills compared with skills from other repositories
| Mod | Type | Stars | Last push | Licence | Scan | Tokens | Works with |
|---|---|---|---|---|---|---|---|
| update-skillsgeekfujiwara/CodeAppsDevelopmentStandard | Skill | 78 | yesterday | MIT | A | 255 | Claude Code, Codex |
| sparc-methodologyruvnet/RuView | Skill | 103k | yesterday | MIT | A | 29 | Claude Code |
| architecture-diagrammateaix/mateclaw | Skill | 1.2k | yesterday | Apache-2.0 | A | 15 | Claude Code, Codex |
| product-image-processorAlpacaLabsLLC/skills-for-architects | Skill | 402 | 3d ago | MIT | A | 45 | Claude Code |
| site-historyAlpacaLabsLLC/skills-for-architects | Skill | 402 | 3d ago | MIT | A | 53 | Claude Code |
| modular-skillsathola/claude-night-market | Skill | 348 | yesterday | MIT | A | 24 | Claude Code |
| plugin-reviewathola/claude-night-market | Skill | 348 | yesterday | MIT | A | 23 | Claude Code |