Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add skilld-dev/skilld --skill update-package-skillgit clone --depth 1 https://github.com/skilld-dev/skilldWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/skilld-dev/skilld/update-package-skill)<a href="https://agentmods.dev/skills/skilld-dev/skilld/update-package-skill"><img src="https://agentmods.dev/badge/skills/skilld-dev/skilld/update-package-skill/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/skilld-dev/skilld/update-package-skill"><img src="https://agentmods.dev/badge/skills/skilld-dev/skilld/update-package-skill.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00062 | $0.00986 |
| Opus 5.5 | $0.00025 | $0.00394 |
| Sonnet 5.5 | $0.00012 | $0.00197 |
| Haiku 4.5 | $0.00006 | $0.00099 |
Grade A, and why
update-package-skill scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 5d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 69 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Update a package Skill
Bring an existing package Skill to a new package version with the smallest correct edit.
The current Skill was tested against an earlier version. Trust what the release did not touch.
To write a Skill from nothing, use generate-package-skill.
Inputs
- The current Skill directory, and the package at the new version: a name and version, a directory, or prepared source.
- The tested version is the version the Skill's first paragraph names. If it names none, stop and report that the Skill needs a full rewrite.
- If the tested version equals the new version, change nothing and report that.
1. Copy, then diff
- Copy the current Skill to the destination unchanged. Edit only the copy.
- Diff the two published versions:
npm diff --diff=PACKAGE@OLD --diff=PACKAGE@NEW. For a local package, diff the old tarball against the packed build. - Read the changelog or release notes between the two versions.
- List what changed for a consumer: exports, types, options and their defaults, config keys, error messages, CLI flags, peer ranges, engines, and behaviour the notes describe.
2. Map changes to the Skill
For each change, find the Skill lines it affects: a claim, an example, a trap, a version limit. A change is relevant when it affects a Skill line, or when it adds or breaks something an Agent would get wrong: a new trap, a renamed call, a new required setup step. Internals, refactors, and fixes the Skill never mentioned are not relevant.
If no change is relevant, leave the copy byte-identical and stop. Report "no change needed" with a one-line diff summary.
3. Test the affected lines
- Create one consumer fixture outside the package source, with its own
pnpm-workspace.yaml. Install the new version and the documented peers. - Run each affected example and claim, and each example you add. Compare output with the claim: return values, type errors, build logs, exit codes.
- Run each with one failure input as well, such as a bad option or an unreachable URL.
- Do not re-run untouched examples. The earlier version's tests cover them.
- Wrap every run in
timeout 120. Start servers from your own script, record each process ID you start, and stop only those. Never kill by port or withpkill -f. - Spend about 20 tool calls on testing. Report an affected claim you could not test as untested; never claim it passed.
What ships with it
1 file beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 5d ago Changed · +5 lines 4535afedfbed
- 8d ago First seen · 64 lines · 62 tokens per session scan A 02d4af913acc
update-package-skill is a skill published in the GitHub repository skilld-dev/skilld (326 stars, last pushed 5d ago), licensed MIT. It adds 62 tokens to every session and 986 once invoked, about $0.0002 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-10-08.
Other skills, from other repositories
harness-config-testing
Use when working in the harness-config repository on test strategy, regression coverage, fixtures, docs/TESTING.md, CLI end-to-end checks, projection edge cases, profile and ignore scenarios, or focused quality commands.
frontend-ui
Check layout states, responsive behavior, accessibility, and browser-visible regressions before claiming the UI works.
writing-livekit-scenarios
Creates and maintains the scenarios a LiveKit agent simulation runs, and wires the agent to consume them. Use when the user asks "what should I test", "generate simulation scenarios", "write scenarios for my agent", "add a scenario for X", "organize my scenario files", "my simulations are flaky", "the scenario hits my…
running-livekit-simulations
Runs LiveKit agent simulations and acts on the results. Use when the user says "run my simulations", "regression test my agent before deploying", "run the scenarios", "use lk agent simulate", "did my agent pass", "why did this scenario fail", "run simulations in CI", "test the audio pipeline", "check turn-taking and…
debugging-livekit-agents
Drives a multi-turn conversation with a LiveKit agent running locally to see what it does. Use when the user says "test my agent", "try my agent", "does this work", "why did it call that tool", "it says the wrong thing when I ask X", "test this change", or whenever you have edited an agent and need to check how it…
test-audit
This skill should be used when the user asks to "write a test", "review these tests", "audit tests", "prune low-value tests", or "find duplicate tests", and whenever writing, changing, reviewing, or sweeping tests. Gates new tests and audits low-value, implementation-coupled, or duplicative tests and the test-only…