update-madagents

update-madagents is a skill for Claude Code, Codex from MadGraphTeam/MadAgents. It costs 77 tokens per session (2,418 once invoked), scanned D, original, MIT.

An update tool for MadAgents installations that combines the current version with changes already made in a repository. A three-way merge compares the installed version, the user's files, and the new version.

In plain words
What is it for?
Use it to update an existing MadAgents installation, read its install record, recreate the original version, and merge each generated file with the latest source.
Why use it?
It updates MadAgents while preserving user edits and exposing conflicts when both the user and the new version changed the same part.

Skill for Claude CodeCodex

Install

Getting it into your agent

One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.

agentmods
npx agentmods add skills/madgraphteam/madagents/update-madagents
Any agent
npx skills add MadGraphTeam/MadAgents --skill update-madagents
Clone the repo
git clone --depth 1 https://github.com/MadGraphTeam/MadAgents

Made for: Claude Code, Codex.

Wrote this? Show the measurements

A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.

agentmods badge for update-madagents

README.md
[![agentmods](https://agentmods.dev/badge/skills/madgraphteam/madagents/update-madagents.svg)](https://agentmods.dev/skills/madgraphteam/madagents/update-madagents)
Your own site
<a href="https://agentmods.dev/skills/madgraphteam/madagents/update-madagents"><img src="https://agentmods.dev/badge/skills/madgraphteam/madagents/update-madagents.svg" alt="Measured on agentmods" height="20"></a>
Per session 77 Skills are progressive disclosure: only the name and description are preloaded; the body loads when the skill is used.
When invoked 2,418 The whole file, excluding the scripts and references it only reads on demand.
Security scan D 2 findings. Scan, not verified.
Origin original No closer match found in the catalogue.
Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

ModelPer sessionOnce invoked
Fable 5 $0.00077 $0.02418
Opus 5 $0.00039 $0.01209
Sonnet 5 $0.00015 $0.00484
Haiku 4.5 $0.00008 $0.00242

Measured 3d ago against content hash 0580e1ed150a, method: parsed. Prices are Anthropic first-party input rates as of 2026-08-30, from the pricing page.

Security

Grade D, and why

update-madagents scanned grade D with 2 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 3d ago.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Reads agent configuration directoriesmediumAgent snooping

.claude/, .codex/, .gemini/ hold keys, settings and other credentials a mod has no legitimate need for.

config.toml) echo "$TARGET/.codex/config.toml" ;;

Recursive force deletehighDestructive command

rm -rf with a variable or a broad path is one typo away from removing the wrong tree.

rm -rf "$BASE_SRC" "$BASE" "$NEW"
legacy/madagents_v2/install/claude_code/.claude/skills/update-madagents/SKILL.md · 184 lines

How it starts

The opening of the file, as written. The whole thing — 184 lines — stays where its author put it; the contents beside it link to each section on GitHub.

Update MadAgents

Update an existing install in place. The core idea is a 3-way merge per file:

  • base = the pristine original of the version the user installed — reconstructed by rendering that version's templates from git history (not a local copy the user could edit).
  • current = what's in the repo now (base + the user's edits).
  • new = the current version, freshly rendered.

git merge-file current base new then does the right thing per file: unchanged → take new; user-edited only → keep theirs; both → merge (clean keeps both; overlapping → conflict).

Uses the same per-provider adapters/<provider>/render.sh as install, so base and new render identically — the only differences come from the version change itself.

Procedure

1. Detect the install and read the manifest

TARGET="<repo path>"; MANIFEST="$TARGET/.madagents/install.json"
test -f "$MANIFEST" || { echo "No manifest — see Legacy fallback"; }
get(){ python3 -c "import json,sys;print(json.load(open('$MANIFEST')).get(sys.argv[1],''))" "$1"; }
COMMIT="$(get source_commit)"; INSTALLED="$(get version)"      # the commit id is all we need
PROVIDER="$(get provider)"; [ -n "$PROVIDER" ] || PROVIDER=claude_code   # legacy installs = claude_code
DOCS_DST="$TARGET/.madagents/madgraph_docs"; DOCS="$DOCS_DST"   # derived from the target, not stored
# Provider-specific instruction file + its block-payload name:
if [ "$PROVIDER" = codex ]; then IFILE="$TARGET/AGENTS.md"; IBLOCK="AGENTS.block.md"
else IFILE="$TARGET/.claude/CLAUDE.md"; IBLOCK="CLAUDE.block.md"; fi

2. Locate source, compare versions

SOURCE="$(git -C "$PWD" rev-parse --show-toplevel)"
RENDER="$SOURCE/install/data/madagents/adapters/$PROVIDER/render.sh"
NEW_VERSION="$(git -C "$SOURCE" describe --tags --always --dirty)"
NEW_COMMIT="$(git -C "$SOURCE" rev-parse HEAD)"
[ "$NEW_COMMIT" = "$COMMIT" ] && { echo "Already at $INSTALLED — up to date."; exit 0; }
echo "Updating: $INSTALLED  ->  $NEW_VERSION"

Read the full file on GitHub · 184 lines

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

  1. 3d ago First seen · 184 lines · 77 tokens per session scan D 0580e1ed150a

Subscribe to this mod's changes

update-madagents is a skill published in the GitHub repository MadGraphTeam/MadAgents (10 stars, last pushed 28d ago), licensed MIT. It adds 77 tokens to every session and 2,418 once invoked, about $0.0004 per session on Opus 5. A static security scan graded it D with 2 findings (reads agent configuration directories, recursive force delete). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.

Related

Other skills, from other repositories

systematic-debugging

Use when encountering any bug, test failure, or unexpected behavior, before proposing fixes.

obra/superpowers · 21 tokens

brainstorming

You MUST use this before any creative work - creating features, building components, adding functionality, or modifying behavior. Explores user intent, requirements and design before implementation.

obra/superpowers · 37 tokens

auto-perf-optimize

Run agent-driven VS Code performance or memory investigations. Use when asked to launch Code OSS, automate a VS Code scenario, run the Chat memory smoke runner, capture renderer heap snapshots, take workflow screenshots, compare run summaries, or drive a repeatable scenario before heap-snapshot analysis.

microsoft/vscode · 62 tokens

chat-perf

Run chat perf benchmarks and memory leak checks against the local dev build or any published VS Code version. Use when investigating chat rendering regressions, validating perf-sensitive changes to chat UI, or checking for memory leaks in the chat response pipeline.

microsoft/vscode · 51 tokens

chat-pet-sprite-creation

Use when creating or changing VS Code chat pet sprite art, sprite sheets, state animations, eye treatments, Stable/Insiders variants, or pet transitions under src/vs/workbench/contrib/chat/browser/widget/media/chatPet.

microsoft/vscode · 53 tokens

cpu-profile-analysis

Analyze V8/Chrome CPU profiles (.cpuprofile) and DevTools trace files (Trace-.json). Use when: profiling performance, investigating slow functions, comparing code paths, finding bottlenecks, analyzing timeToRequest, understanding call trees from sampling profiler data, analyzing layout/paint/rendering, investigating…

microsoft/vscode · 71 tokens