Borrowing it
Nothing to install: this file belongs to phun333/pi-infobar. Take a copy, put it at the same path in your own repository, and replace the rules that are about this project with yours.
curl -O https://raw.githubusercontent.com/phun333/pi-infobar/main/.agents/skills/macos-auto-update/SKILL.mdgit clone --depth 1 https://github.com/phun333/pi-infobarWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/phun333/pi-infobar/macos-auto-update)<a href="https://agentmods.dev/skills/phun333/pi-infobar/macos-auto-update"><img src="https://agentmods.dev/badge/skills/phun333/pi-infobar/macos-auto-update.svg" alt="Measured on agentmods" height="20"></a>- NVIDIA SkillSpector warn
SkillSpector: 6 findings, up to medium
These are SkillSpector’s own severities. On a checked sample its high-severity flags on skills were ~96% false positives — a documented command, a public API, a “never do X” rule — so we show them as a caution to read, not a verdict. Why →
- medium Rogue Agent · line 9 Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.Fix: Remove any persistence mechanisms (cron jobs, startup scripts, state files). Skills should not maintain state across sessions without explicit user consent.
- medium Rogue Agent · line 22 Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.Fix: Remove any persistence mechanisms (cron jobs, startup scripts, state files). Skills should not maintain state across sessions without explicit user consent.
- medium Rogue Agent · line 57 Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.Fix: Remove any persistence mechanisms (cron jobs, startup scripts, state files). Skills should not maintain state across sessions without explicit user consent.
- medium Rogue Agent · line 59 Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.Fix: Remove any persistence mechanisms (cron jobs, startup scripts, state files). Skills should not maintain state across sessions without explicit user consent.
- medium Rogue Agent · line 87 Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.Fix: Remove any persistence mechanisms (cron jobs, startup scripts, state files). Skills should not maintain state across sessions without explicit user consent.
- medium Rogue Agent · line 159 Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.Fix: Remove any persistence mechanisms (cron jobs, startup scripts, state files). Skills should not maintain state across sessions without explicit user consent.
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00126 | $0.01769 |
| Opus 5 | $0.00063 | $0.00885 |
| Sonnet 5 | $0.00025 | $0.00354 |
| Haiku 4.5 | $0.00013 | $0.00177 |
Grade A, and why
macos-auto-update scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 8d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
Copies of this mod
1 near-identical copy found in the catalogue:
- macos-auto-update — 100% identical, 0 lines differ
How it starts
The opening of the file, as written. The whole thing — 202 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Sparkle Auto-Update for macOS Apps
This skill adds Sparkle auto-update support to a native macOS app. Sparkle is the standard open-source framework for macOS app updates outside the Mac App Store.
Overview
The implementation has 4 parts:
- SPM dependency -- add the Sparkle package to the Xcode project
- UpdaterManager.swift -- a singleton that wraps
SPUStandardUpdaterController - Info.plist keys --
SUFeedURLandSUPublicEDKey - UI integration -- "Check for Updates" button in settings/menu bar
Step 1: Add Sparkle via SPM
In Xcode: File > Add Package Dependencies > enter:
https://github.com/sparkle-project/Sparkle
Use the "Up to Next Major Version" rule with 2.0.0. Add the Sparkle framework to your app target.
Or add it to Package.swift if your project uses one:
.package(url: "https://github.com/sparkle-project/Sparkle", from: "2.0.0")
Step 2: Create UpdaterManager.swift
Copy references/UpdaterManager.swift into your project. This is a singleton that:
- Creates
SPUStandardUpdaterControllerearly (beforeapplicationDidFinishLaunchingreturns) - Publishes
canCheckForUpdatesfor UI binding - Exposes
automaticallyChecksForUpdatestoggle - Skips all update logic in DEBUG builds (so you don't get update prompts during development)
- For menu-bar-only apps: temporarily switches to
.regularactivation policy before showing the update window
The key design decisions in this file:
startingUpdater: falsein the initializer, then callingstart()explicitly inapplicationDidFinishLaunching. This gives you control over timing.- DEBUG guards on
start()andcheckForUpdates(). Sparkle should never run in debug builds -- it would try to update your debug app with a release build. ObservableObjectwith@Published(not@Observable) because we need the Combinepublisher(for:)bridge from Sparkle's KVO.
Step 3: Configure Info.plist
What ships with it
1 file beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 8d ago First seen · 202 lines · 126 tokens per session scan A 375b29ad2fe7
macos-auto-update is a skill published in the GitHub repository phun333/pi-infobar (93 stars, last pushed 2mo ago), licensed MIT. It adds 126 tokens to every session and 1,769 once invoked, about $0.0006 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
harbofly-cleanup
Reclaim disk space on a macOS developer machine by finding and safely cleaning build caches and artifacts (Xcode DerivedData, nodemodules, Docker, and package-manager/editor/AI caches) with the Harbofly CLI. Everything goes to the Trash and is recoverable. Use when the user wants to free up disk space, clean dev…
app-store-review
Evaluates code against Apple's App Store Review Guidelines. Use this skill when reviewing iOS, macOS, tvOS, watchOS, or visionOS app code (Swift, Objective-C, React Native, or Expo) to identify potential App Store rejection issues before submission. Triggers on tasks involving app review preparation, compliance…
swift-concurrency-pro
Reviews Swift code for concurrency correctness, modern API usage, and common async/await pitfalls. Use when reading, writing, or reviewing Swift concurrency code.
swift-testing-pro
Writes, reviews, and improves Swift Testing code using modern APIs and best practices. Use when reading, writing, or reviewing projects that use Swift Testing.
swiftui-pro
Comprehensively reviews SwiftUI code for best practices on modern APIs, maintainability, and performance. Use when reading, writing, or reviewing SwiftUI projects.
onlyswitch-deeplink
Invoke OnlySwitch built-in switches or buttons via deeplink. Use when the user asks to toggle or trigger an OnlySwitch action (e.g. empty trash, keep awake, dark mode, mute, hide desktop, clear clipboard, eject discs, Xcode derived data, and any other built-in switch or button). Resolve the request to the correct…