Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add skills/generous-corp/pulp/upgradenpx skills add Generous-Corp/pulp --skill upgradegit clone --depth 1 https://github.com/Generous-Corp/pulpWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/generous-corp/pulp/upgrade)<a href="https://agentmods.dev/skills/generous-corp/pulp/upgrade"><img src="https://agentmods.dev/badge/skills/generous-corp/pulp/upgrade.svg" alt="Measured on agentmods" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00092 | $0.04748 |
| Opus 5 | $0.00046 | $0.02374 |
| Sonnet 5 | $0.00018 | $0.00950 |
| Haiku 4.5 | $0.00009 | $0.00475 |
Grade C, and why
upgrade scanned grade C with 2 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured today.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Downloads and executes remote codehighSupply chain
curl | sh runs whatever the server returns today, which is not necessarily what it returned when this was reviewed.
(`curl -fsSL https://www.generouscorp.com/pulp/install.sh | sh`) Makes network callslowCapability
Not a fault in itself. Listed so you know the mod talks to something, and to what.
(`curl -fsSL https://www.generouscorp.com/pulp/install.sh | sh`) How it starts
The opening of the file, as written. The whole thing — 441 lines — stays where its author put it; the contents beside it link to each section on GitHub.
upgrade
When this skill applies
- User asks to upgrade, update, or bump the Pulp CLI.
- User runs
/upgradein Claude Code. - User asks "what changed", "what's new", "what breaks", or "how do I migrate" after bumping an SDK / CLI version.
- A
pulp doctor --versionsrun surfaces CLI-vs-SDK skew the user wants to resolve.
This skill does NOT cover:
- Pinning the project's SDK version — that's the
cli-maintenanceskill +pulp project pin. - Bumping the Pulp framework/source checkout version — that's
pulp version bumpplus the release workflow. - Shipping a PR from a dev branch — that's the
ciskill viapulp pr. - Updating the Shipyard pin — that's the Dependency Update Workflow in
CLAUDE.md(runs throughtools/deps/audit.py).
Mental model
Four independently-versioned surfaces, two of which this skill acts on
directly and one of which it may hand off to pulp project pin:
| Surface | Source of truth | How to upgrade |
|---|---|---|
| Pulp CLI / SDK | ~/.pulp/bin/pulp (installed binary) |
pulp upgrade |
| Consumer project SDK pin | project pulp.toml sdk_version + find_package(Pulp X.Y.Z ...) |
pulp project pin |
| Pulp source checkout version | Pulp repo CMakeLists.txt / release metadata |
pulp version bump + release workflow |
| Claude plugin | .claude-plugin/plugin.json |
/plugin install pulp in Claude Code |
| Shipyard pin | tools/install-shipyard.sh |
Dependency Update Workflow (out of scope) |
pulp upgrade downloads the new CLI binary and replaces the installed
one. After the Phase 8 Rust cutover, release archives are dual-binary:
Rust pulp is the user-facing CLI and sibling pulp-cpp is installed
as the C++ fallthrough delegate. A healthy install has both
~/.pulp/bin/pulp and ~/.pulp/bin/pulp-cpp; use PULP_USE_CPP=1 pulp <args> or direct pulp-cpp <args> only for rollback/debug
comparisons. Do not hand-swap binaries in user/system locations.
The C++ cmd_upgrade.cpp path still matters for pre-cutover users
upgrading into a Rust release: it must copy the archive's sibling
payloads, including pulp-cpp, before replacing the running pulp
binary.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- today First seen · 441 lines · 92 tokens per session scan C 2b2866e5af59
upgrade is a skill published in the GitHub repository Generous-Corp/pulp (16 stars, last pushed today), licensed MIT. It adds 92 tokens to every session and 4,748 once invoked, about $0.0005 per session on Opus 5. A static security scan graded it C with 2 findings (downloads and executes remote code, makes network calls). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-09-04.
Other skills, from other repositories
orbit-notion
Open Orbit briefing skill — selected by the Orbit pipeline when Notion is the user's only connected connector, or when the user explicitly scopes their daily digest to Notion. Pulls the past 24 hours of document edits, comments, mentions, and database row changes from the user's authenticated Notion connection and…
Cortex
Operate Cortex, the LifeOS memory system — the typed Knowledge Archive (People, Companies, Ideas, Research with typed related: links) plus recall of prior work sessions, ISAs, and conversations. Search, add, harvest, develop, ingest, distill, graph-navigate, recall. USE WHEN cortex, knowledge, knowledge base, search…
pinchtab-mcp
Use this skill when a task requires browser automation through PinchTab's MCP server connected to a remote browser instance. Covers navigation, element interaction, data extraction, form filling, multi-step flows, and session management via MCP tools.
feishu
Work with Feishu or Lark bots, docs, sheets, bitables, approval flows, and OpenAPI/MCP setup without hardcoding credentials.
peekaboo
Capture and automate macOS UI with the Peekaboo CLI.
mochi-remind
Handle due reminders — notify the user with natural language and mark them done.