applying-updates

A guarded workflow for applying previously previewed changes to a project after explicit confirmation.

In plain words
What is it for?
Use it to commit a prepared draft, report how many changes were applied, and direct the user to validation.
Why use it?
It prevents accidental writes by requiring a valid preview and a clear confirmation before committing changes.

Skill for Claude CodeCodex

Install

Getting it into your agent

One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.

agentmods
npx agentmods add skills/roynertr/cobie-mcp/applying-updates
Any agent
npx skills add roynertr/cobie-mcp --skill applying-updates
Clone the repo
git clone --depth 1 https://github.com/roynertr/cobie-mcp

Made for: Claude Code, Codex.

Per session 16 Skills are progressive disclosure: only the name and description are preloaded; the body loads when the skill is used.
When invoked 333 The whole file, excluding the scripts and references it only reads on demand.
Security scan A 0 findings. Scan, not verified.
Origin original No closer match found in the catalogue.
Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

ModelPer sessionOnce invoked
Fable 5 $0.00016 $0.00333
Opus 5 $0.00008 $0.00167
Sonnet 5 $0.00003 $0.00067
Haiku 4.5 $0.00002 $0.00033

Measured yesterday against content hash 0f5cd1832504, method: parsed. Prices are Anthropic first-party input rates as of 2026-08-30, from the pricing page.

Security

Grade A, and why

applying-updates scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured yesterday.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Nothing flagged

None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.

server/runtime_skills/applying-updates/SKILL.md · 42 lines

What it actually says

Applying Updates

Inputs assumed

  • pending_preview_id (required; apply blocked if none)
  • active_project (excel_path resolved from project)
  • pending_operation.draft (the draft to commit)

Tool sequence

  1. Verify pending_preview_id exists
  2. Verify confirm_token === "CONFIRM_APPLY" or user typed "CONFIRM APPLY"
  3. commit_changes (update_cobie or capture_installation with dry_run=false)

Output template

  • Summary: "Applied N changes."
  • Bullets: summary of changes (max 5)
  • CTA: "Validation complete. Type 'validate' to re-check."
  • Optional: "Type 'show details' to see full diffs"

Forbidden actions

  • Never call update_cobie without confirm_token CONFIRM_APPLY
  • Never apply when pending_preview_id is missing
  • Never skip the confirmation gate

Tool usage rules

  1. Require pending_preview_id; reject apply if missing
  2. Require confirm_token "CONFIRM_APPLY" from UI or "CONFIRM APPLY" from user message
  3. Call commit_changes with draft from pending_operation

Confirmation gates

  • Require explicit confirm token before any write
  • UI button sends confirm_token: "CONFIRM_APPLY"
  • Or user must type "CONFIRM APPLY" (case-insensitive)

Output formatting

Return human summary + bullet list (max 5) + CTA. Do not output raw JSON unless asked.

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

  1. yesterday First seen · 42 lines · 16 tokens per session scan A 0f5cd1832504

Subscribe to this mod's changes

applying-updates is a skill published in the GitHub repository roynertr/cobie-mcp (1 stars, last pushed 29d ago), licensed MIT. It adds 16 tokens to every session and 333 once invoked, about $0.0001 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.

Related

Other skills, from other repositories

scrape-batch

Extract many known URLs in one polite, rate-limited pass. Use when the user hands over a list of links, a set of search hits to read in full, or asks to "scrape these pages" / "pull the content from all of them". Drives extract(action="batch"), which fans out with per-domain rate limiting and returns partial results…

n24q02m/wet-mcp · 84 tokens

memory-commit

Use when the user explicitly says "remember this", "save this", "ghi nho", "luu lai", "save for next time", or otherwise asks to persist the immediately preceding context. Captures with the appropriate contexttype (decision, preference, fact, skill, task, conversation) so future sessions can retrieve it accurately.

n24q02m/mnemo-mcp · 72 tokens

recall-context

Use at session start, before significant decisions, or when a new task references a known project to recall mnemo memories matching the current working directory, recently edited files, or topic keywords. Helps maintain continuity across sessions and avoid redoing past research.

n24q02m/mnemo-mcp · 53 tokens

session-handoff

End-of-session knowledge capture — decisions, preferences, corrections, conventions, open questions.

n24q02m/mnemo-mcp · 20 tokens

octave-compression

Workflow for transforming prose into semantic OCTAVE structures. Covers tier selection, transformation phases, loss accounting, and decision rules. REQUIRES octave-literacy.

elevanaltd/octave-mcp · 36 tokens

query-superset

Run bounded SELECT queries through an Apache Superset SQL Lab connection on Windows. Use when a user wants an Agent to configure a supported Superset instance, test connectivity, inspect tables or columns, execute SELECT queries, export small results, preserve query evidence, or diagnose authentication, permission…

Bono12138/bonobox · 73 tokens