Borrowing it
Nothing to install: this file belongs to philipyaz/cos. Take a copy, put it at the same path in your own repository, and replace the rules that are about this project with yours.
curl -O https://raw.githubusercontent.com/philipyaz/cos/main/.claude/skills/cos-upgrade/SKILL.mdgit clone --depth 1 https://github.com/philipyaz/cosWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/philipyaz/cos/cos-upgrade)<a href="https://agentmods.dev/skills/philipyaz/cos/cos-upgrade"><img src="https://agentmods.dev/badge/skills/philipyaz/cos/cos-upgrade/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/philipyaz/cos/cos-upgrade"><img src="https://agentmods.dev/badge/skills/philipyaz/cos/cos-upgrade.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00237 | $0.03910 |
| Opus 5 | $0.00118 | $0.01955 |
| Sonnet 5 | $0.00047 | $0.00782 |
| Haiku 4.5 | $0.00024 | $0.00391 |
Grade C, and why
cos-upgrade scanned grade C with 2 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 5d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Downloads and executes remote codehighSupply chain
curl | sh runs whatever the server returns today, which is not necessarily what it returned when this was reviewed.
curl -fsS --max-time 5 "$BOARD_URL/api/healthz" | node -e 'let s="";process.stdin.on("data",d=>s+=d).on("end",()=>{const j=JSON.parse(s);const w=Number(process.argv[1]);console.log("hub app",j.appVersion,"schema",j.schem Makes network callslowCapability
Not a fault in itself. Listed so you know the mod talks to something, and to what.
[ "${COS_DEVICE_ROLE:-hub}" = hub ] && curl -s "$BOARD_URL/api/healthz" # note appVersion / schemaVersion / diskSchemaVersion BEFORE How it starts
The opening of the file, as written. The whole thing — 209 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Cos — upgrade an existing install (the post-pull runbook)
git pull changes files. It does not rebuild the production board, restart a launchd bridge that
still runs the old server code, hand Cowork the rebuilt skill bundle it installed months ago, or create
the scheduled trigger automation.json just gained. Each of those is a silent no-op — the repo is
green, the tests pass, and your sweeps run last month's procedure. Only the store takes care of
itself, and only in one direction: it migrates up on the next read, and refuses every write when
the code is older than the file (503 store-newer-than-code) — see
docs/reference/migration.md.
This skill is the deterministic answer. The planner (scripts/upgrade-check.mjs) turns what your
pull changed into the ordered list of what this machine must do; you apply it. Never re-run
cos-setup to upgrade — it is the first-run path and assumes empty state.
Roles. A hub runs the board, the store, the sidecars and the backup. A spoke runs only the board-facing MCP wrappers. Upgrade the hub first, then every spoke (a wrapper newer than the hub calls routes the hub does not have yet).
Step 0 — preflight (read-only)
source "$(git rev-parse --show-toplevel)/config/load-config.sh" # REPO_ROOT, BOARD_URL, ports, COS_DEVICE_ROLE
cd "$REPO_ROOT"
git status --porcelain # must be EMPTY — a dirty tree makes the pull ambiguous; stash or commit first
git rev-parse --abbrev-ref HEAD # expect main (an upgrade tracks main or a release tag, never a feature branch)
PRE_PULL="$(git rev-parse HEAD)"; echo "running: $PRE_PULL"
echo "role: ${COS_DEVICE_ROLE:-hub}"
[ "${COS_DEVICE_ROLE:-hub}" = hub ] && curl -s "$BOARD_URL/api/healthz" # note appVersion / schemaVersion / diskSchemaVersion BEFORE
CHECKPOINT: clean tree on main, PRE_PULL captured, healthz answered (hub). On a spoke, also
confirm the hub is already upgraded: curl -s "$BOARD_URL/api/healthz" must report an appVersion /
schemaVersion ≥ what you are about to pull (compare with git show origin/main:package.json and
git show origin/main:board/lib/types.ts | grep SCHEMA_VERSION).
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 5d ago Changed · +5 lines bfd37f881ecf
- 10d ago First seen · 204 lines · 237 tokens per session scan C 47f4bd0051a8
cos-upgrade is a skill published in the GitHub repository philipyaz/cos (4 stars, last pushed today), licensed MIT. It adds 237 tokens to every session and 3,910 once invoked, about $0.0012 per session on Opus 5. A static security scan graded it C with 2 findings (downloads and executes remote code, makes network calls). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
tensorrt-llm
High-throughput LLM inference on NVIDIA GPUs.
stripe-projects
Provision SaaS services + sync creds via Stripe Projects.
cloud-sync
Set up or check claude-mem cloud sync with cmem.ai Pro. Use when the user says "set up cloud sync", "sync my memories", "cmem pro", "cloud backup", "sync status", or wants their memory database backed up or synced to their cmem.ai account.
cli-backup-sync
Backup and restore OmniRoute data from the CLI. Trigger incremental snapshots, sync to cloud storage, manage backup schedules, and restore from archive files.
cost-optimization
Optimize cloud costs across AWS, Azure, GCP, and OCI through resource rightsizing, tagging strategies, reserved instances, and spending analysis. Use when reducing cloud expenses, analyzing infrastructure costs, or implementing cost governance policies.
istio-traffic-management
Configure Istio traffic management including routing, load balancing, circuit breakers, and canary deployments. Use when implementing service mesh traffic policies, progressive delivery, or resilience patterns.