Getting it into your agent
It runs from inside its repository, so the clone comes first — what it calls does not travel with the file alone.
git clone --depth 1 https://github.com/novoads/agent-skillsnpx agentmods add skills/novoads/agent-skills/novoads-updateWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/novoads/agent-skills/novoads-update)<a href="https://agentmods.dev/skills/novoads/agent-skills/novoads-update"><img src="https://agentmods.dev/badge/skills/novoads/agent-skills/novoads-update/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/novoads/agent-skills/novoads-update"><img src="https://agentmods.dev/badge/skills/novoads/agent-skills/novoads-update.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00186 | $0.04443 |
| Opus 5 | $0.00093 | $0.02221 |
| Sonnet 5 | $0.00037 | $0.00889 |
| Haiku 4.5 | $0.00019 | $0.00444 |
Grade B, and why
novoads-update scanned grade B with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 9d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Reads agent configuration directoriesmediumAgent snooping
.claude/, .codex/, .gemini/ hold keys, settings and other credentials a mod has no legitimate need for.
grep -q 'auto-update' .claude/settings.json && echo "reader: registered" How it starts
The opening of the file, as written. The whole thing — 356 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Update the pack
This pack is a git clone. Updating it is a merge, and a merge on someone else's working tree is a decision only they can make — so this skill's real product is the question, not the update. Ask, then do exactly what was answered.
Notify-only is the default and stays the default. Nothing here turns on unattended updating unless the user picks the option that says so, in their own words, in the dialog below.
Step 0 — confirm this is the pack clone, before anything else
This skill manages a cloned pack: a git repository with scripts/update.sh
in it. It can also be installed on its own, copied into someone's ~/.claude/
alongside skills that have nothing to do with this repo — and in that shape
every instruction below is pointed at the wrong repository. Step 1's git
commands would report on the user's own project, and option 2 would write a
consent flag into a directory no hook will ever read.
Every command in this skill runs from the clone root. Move there first, and keep doing it at the top of each block below — a session can open anywhere, and this is the one thing that silently changes what the commands mean:
root="$(git rev-parse --show-toplevel 2>/dev/null)" && [ -n "$root" ] && cd "$root"
if git remote get-url origin 2>/dev/null | grep -qE 'novoads/(claude-code-ads|agent-skills)' \
|| [ -f shared/scripts/auto-update.sh ]; then
echo "pack clone confirmed"
else
echo "NOT the pack clone — stop here"
fi
Both slugs, on purpose. The repo was novoads/claude-code-ads until
2026-08-13 and is novoads/agent-skills now. GitHub's 301 keeps every clone
made before the rename working — git fetch follows it — but it does not
rewrite origin in that clone's config, so those users' remote still reads the
old slug and always will until they re-point it. Matching only the new name
would tell every pre-rename clone it is not the pack, which is exactly the
population this skill exists to update.
Git commands walk up to find the repository; plain paths do not. From a
subdirectory ./scripts/update.sh is simply not found, [ -f shared/scripts/... ]
reports a false negative on a real clone, and a .update-state/config written
there lands somewhere no hook will ever read — consent recorded, nothing
reading it, which is the exact failure this pack's design exists to prevent.
What ships with it
2 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 9d ago First seen · 356 lines · 186 tokens per session scan B eaa288af50db
novoads-update is a skill published in the GitHub repository novoads/agent-skills (14 stars, last pushed 14d ago), licensed MIT. It adds 186 tokens to every session and 4,443 once invoked, about $0.0009 per session on Opus 5. A static security scan graded it B with 1 finding (reads agent configuration directories). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
commit
Stage, commit, push, open a PR, and merge to main. Use ONLY on explicit commit intent — user says "commit", "ship it", "push this", "open a PR", "merge to main", "let's commit this", or prefixes with /commit. Do NOT auto-invoke on vague end-of-task phrases ("we're done", "wrap up") — those require explicit…
changelog-generator
Generate changelogs from git commits. Use when user says "generate changelog", "update changelog", "what changed since last release", or before preparing a new release.
git-commit
Generate conventional commit messages for Java projects. Use when user says "commit", "create commit", "commit changes", or after completing code changes that need to be committed.
release
CONTRIBUTOR TOOL - Cut a plugin release: bump plugin.json version, finalize CHANGELOG, update README if needed, gate on make ci, commit, tag vX.Y.Z, and create the GitHub release. Use when shipping a new plugin version. NOT distributed.
catchup
Summarize and review what changed while you were away. Use after a weekend, vacation, or flight to check missed PRs, git commits, Linear tickets, and meetings — one prioritized brief, not a firehose.
pr-review
Address feedback left on a GitHub pull request: fetch unresolved review threads, make agreed Elixir/Phoenix code fixes, reply, and resolve. Use for a PR URL/number or reviewer comments. NOT for pre-PR review, findings triage, or CI monitoring.