Row-Bot is a local-first desktop AI assistant that combines language models with memory and tools for working across files, repositories, workflows, and communication channels. It is intended for people who want an assistant that can run locally while keeping application data on their machine.
Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add siddsachar/row-bot --skill updater_guidegit clone --depth 1 https://github.com/siddsachar/row-botWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/siddsachar/row-bot/updater_guide)<a href="https://agentmods.dev/skills/siddsachar/row-bot/updater_guide"><img src="https://agentmods.dev/badge/skills/siddsachar/row-bot/updater_guide/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/siddsachar/row-bot/updater_guide"><img src="https://agentmods.dev/badge/skills/siddsachar/row-bot/updater_guide.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector warn
SkillSpector: 1 finding, up to medium
These are SkillSpector’s own severities. On a checked sample its high-severity flags on skills were ~96% false positives — a documented command, a public API, a “never do X” rule — so we show them as a caution to read, not a verdict. Why →
- medium Excessive Agency · line 46 Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.Fix: Add human-in-the-loop confirmation for destructive, irreversible, or high-impact operations. Never auto-execute commands that modify files, send data, or alter system state.
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00017 | $0.00587 |
| Opus 5.5 | $0.00007 | $0.00235 |
| Sonnet 5.5 | $0.00003 | $0.00117 |
| Haiku 4.5 | $0.00002 | $0.00059 |
Grade A, and why
updater_guide scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 6d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
What it actually says
ROW-BOT AUTO-UPDATE:
- An installed Row-Bot checks GitHub Releases about once a day and, by default, downloads and prepares a new release in the background, next to the running version. Only what changed is downloaded and every file is checked. Nothing changes until Row-Bot restarts or quits.
- The person controls this in Settings › Updates: "Check for updates automatically" and "Download updates automatically" (both on by default), and the Stable or Beta channel. Do not change them without asking.
- A ready update shows "Restart to update" in the sidebar and the tray. If it is ignored, it installs the next time Row-Bot quits.
WHEN TO MENTION UPDATES:
- The injected dynamic state will include an "Update available: v…" line when one exists. If the person asks "what's new" or "is there an update", give the version and a one-line summary.
- Do NOT nag: mention it proactively at most once per conversation.
- If an update is in
skipped_versions, do not offer it again unless the person asks.
CHECKING (row_bot_check_for_updates):
- Read-only. Asks GitHub once and returns the available version (if any), whether one is already downloaded and ready, the summary and the release page. Failures (offline, rate-limited) are reported, not treated as errors.
INSTALLING (row_bot_install_update):
- Follows the thread's approval mode; it always describes what it will do.
- With nothing ready: downloads and prepares the release in the background. Settings › Updates then shows Restart now.
- With an update ready: schedules the restart for as soon as nothing is running (after this reply). If the new version doesn't start, Row-Bot goes back to the current one by itself.
- "Needs the full installer" means the release changes Row-Bot's runtime: give the person the installer link it returns.
- Refuses on a development checkout. Docker and other host-updated installs have no update tools: their host installs updates.
GOING BACK:
- Settings › Updates › Repair ("Go back to x.y.z") restarts into the previous version. Point the person there if a new version misbehaves.
ERROR HANDLING:
- A checksum or preparation failure: do NOT retry blindly. Surface the message and point to Settings › Updates (Try again) or the release page.
- Network failure: a one-line "couldn't reach GitHub" suffices.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 6d ago Changed 3c99e2456614
- 1mo ago First seen · 54 lines · 17 tokens per session scan A cbed6d914ebd
updater_guide is a skill published in the GitHub repository siddsachar/row-bot (1,632 stars, last pushed today), licensed Apache-2.0. It adds 17 tokens to every session and 587 once invoked, about $0.0001 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
github-repo-management
Clone, create, fork, configure, and manage GitHub repositories. Manage remotes, secrets, releases, and workflows. Works with gh CLI or falls back to git + GitHub REST API via curl.
update-recovery
Use when an update leaves out owner customizations or they need restoring or merging.
pre-release-check
The final gate before a release is cut — go green, reconcile the release PR against what actually landed, sweep what CI can't see, check the roadmap and ADR statuses, optionally deep-review, then return a ship-or-hold verdict.
land-and-deploy
Merge PR, wait for CI, verify deploy, run canary. The complete landing pipeline.
release-notes-generator
Generate release notes in 3 formats (CHANGELOG.md, PR body, Slack announcement) from git commits. Automatically categorizes changes and converts technical language to user-friendly messaging. Use for releases, changelogs, version notes, what's new summaries, or ship announcements.
release-notes
Generate release notes in multiple formats from git commits.