update

update is a skill for Claude Code from Jebel-Quant/rhiza-claude. It costs 44 tokens per session (2,833 once invoked), scanned A, original, MIT.

A command that updates a Rhiza-managed repository to a newer shared template release and opens a pull request containing only template-owned files. A pull request is a proposed change for review before merging.

In plain words
What is it for?
Use it to sync the latest template, or a specified version, and prepare the changes for review.
Why use it?
It keeps shared repository setup current while preventing unrelated project edits from being included in the update.

Skill for Claude Code

Written for Claude Code: allowed-tools in frontmatter. Also seen: names the AskUserQuestion tool; mentions Claude Code.

Runs only inside its plugin — its command needs a path that Claude Code sets for a plugin’s own hooks and for nothing else. Install the plugin, not this.

Part of the rhiza plugin — 10 skills, 1 hook shipped together

Good fit Use it to sync the latest template, or a specified version, and prepare the changes for review.

Compare 6 skills from other repositories ↓
Install

Getting it into your agent

This one installs as part of its plugin. Adding the marketplace and installing the plugin brings it with everything else the plugin ships.

Claude Code
/plugin marketplace add Jebel-Quant/rhiza-claude
Claude Code
/plugin install rhiza

Made for: Claude Code.

Or install rhiza, the plugin that ships this one along with the rest of its 10 skills, 1 hook.

Wrote this? Show the measurements

A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.

agentmods badge for update

README.md
[![agentmods](https://agentmods.dev/badge/skills/jebel-quant/rhiza-claude/update.svg)](https://agentmods.dev/skills/jebel-quant/rhiza-claude/update)
Your own site
<a href="https://agentmods.dev/skills/jebel-quant/rhiza-claude/update"><img src="https://agentmods.dev/badge/skills/jebel-quant/rhiza-claude/update.svg" alt="Measured on agentmods" height="20"></a>
Per session 44 Skills are progressive disclosure: only the name and description are preloaded; the body loads when the skill is used.
When invoked 2,833 The whole file, excluding the scripts and references it only reads on demand.
Security scan A 0 findings. A grade says what 26 rules found in the file — not that it is safe.
Origin original No closer match found in the catalogue.
Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

ModelPer sessionOnce invoked
Fable 5.1 $0.00044 $0.02833
Opus 5 $0.00022 $0.01417
Sonnet 5 $0.00009 $0.00567
Haiku 4.5 $0.00004 $0.00283

Measured 7d ago against content hash 1e34f781a856, method: parsed. Prices are Anthropic first-party input rates as of 2026-09-07, from the pricing page.

Security

Grade A, and why

update scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 7d ago.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Nothing flagged

None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.

plugin/skills/update/SKILL.md · 179 lines

How it starts

The opening of the file, as written. The whole thing — 179 lines — stays where its author put it; the contents beside it link to each section on GitHub.

You are running /update in the current working directory's repo. Goal: bump the template ref, apply the sync, and open a PR with nothing but template-owned files in it.

Only files that come from the template repository may be touched. The sync records exactly which paths it materialized in .rhiza/template.lock's files list, and plugin/scripts/stage_synced.py (step 7) stages precisely that set — so the guarantee is mechanical, not something this prose has to be trusted to honour. Never git add --all and never fold in unrelated edits: no reformatting of the repo's own source, no dependency changes, no test fixes. Anything outside the set stays in the working tree and gets reported.

No gates, no scorecard, no issues. /update syncs; /quality scores. Don't run make test/make lint/make fmt here — make fmt in particular would rewrite the repo's own files and break the rule above. Point the user at /rhiza:quality in the report instead.

Argument (optional): $ARGUMENTS — an explicit template version tag like v1.2.0. If empty, use the template's latest release.

Work through these steps. Stop and report if a precondition fails.

1. Preconditions

  • uv first. Read ${CLAUDE_PLUGIN_ROOT}/prompts/install-uv.md and follow it before anything else (in a source checkout, plugin/prompts/install-uv.md). It's a one-line no-op when uv is already present. The sync runs through uv run --python 3.12, so if uv --version still fails afterwards, stop — don't fall back to a system python3, which on macOS is 3.9 and crashes sync.py on datetime.UTC. (prompts/*.md are internal procedures, not slash commands — not in any directory Claude Code scans, so the user can't invoke them; reach them with Read.)
  • .rhiza/template.yml must exist. If not, stop: "Not a rhiza-managed repo (no .rhiza/template.yml)" — and point at /rhiza:init, which establishes that file.
  • The working tree must be clean (git status --porcelain). If dirty, stop and show the dirty files; the sync refuses a dirty tree anyway (exit 2).
  • Record ORIG_BRANCH (git branch --show-current) — step 8 returns to it — the default branch DEFAULT (gh repo view --json defaultBranchRef --jq .defaultBranchRef.name, else git remote show origin, else main), and the platform from git remote get-url origin (github.com → GitHub/gh; a GitLab host → GitLab/glab).

Read the full file on GitHub · 179 lines

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

  1. 7d ago First seen · 179 lines · 44 tokens per session scan A 1e34f781a856

Subscribe to this mod's changes

update is a skill published in the GitHub repository Jebel-Quant/rhiza-claude (4 stars, last pushed yesterday), licensed MIT. It adds 44 tokens to every session and 2,833 once invoked, about $0.0002 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.