agentmods.dev

kenjaku: Skill for Claude Code

.claude/skills/update-engine/SKILL.md

update-engine is a skill for Claude Code from tpierrain/kenjaku. It costs 87 tokens per session (5,202 once invoked), scanned A, original, Apache-2.0.

A controlled updater for the machinery behind a personal knowledge vault, including its search code, launchers, and related scripts.

In plain words
What is it for?
Use it to check for and approve an engine upgrade, then update the engine and reindex the vault only when the search index format requires it.
Why use it?
It lets you receive engine updates without overwriting your notes, settings, environment file, or customised skills.

Skill for Claude Code

Written for Claude Code: SessionStart hook event. Also seen: reads .claude/ paths; mentions CLAUDE.md; names the AskUserQuestion tool.

This is tpierrain/kenjaku's own configuration. It tells Claude Code how to work on kenjaku itself, so it is not a mod to install elsewhere. Copy it as a starting point and replace the rules that are about this project. Everything kenjaku configures →

Needs its repository: it runs a file that does not travel with it, so clone the repository first. The line is node scripts/update-engine.mjs --check.

not rated 96repo +2 changed 1mo ago A scan SkillSpector: warn 87 tokens original Apache-2.0
View source ↗ tpierrain/kenjaku
Reuse

Borrowing it

Nothing to install: this file belongs to tpierrain/kenjaku. Take a copy, put it at the same path in your own repository, and replace the rules that are about this project with yours.

Copy the file
curl -O https://raw.githubusercontent.com/tpierrain/kenjaku/main/.claude/skills/update-engine/SKILL.md
Clone the repo
git clone --depth 1 https://github.com/tpierrain/kenjaku

Made for: Claude Code.

Wrote this? Show the measurements

A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.

agentmods badge for update-engine

README.md
[![agentmods](https://agentmods.dev/badge/skills/tpierrain/kenjaku/update-engine/github.svg)](https://agentmods.dev/skills/tpierrain/kenjaku/update-engine)
Your own site
<a href="https://agentmods.dev/skills/tpierrain/kenjaku/update-engine"><img src="https://agentmods.dev/badge/skills/tpierrain/kenjaku/update-engine/github.svg" alt="Measured on agentmods" height="20"></a>

Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.

agentmods 80×15 button for update-engine

Your own site · 80×15
<a href="https://agentmods.dev/skills/tpierrain/kenjaku/update-engine"><img src="https://agentmods.dev/badge/skills/tpierrain/kenjaku/update-engine.svg" alt="Reviewed on agentmods" width="80" height="20"></a>
Per session 87 Skills are progressive disclosure: only the name and description are preloaded; the body loads when the skill is used.
When invoked 5,202 The whole file, excluding the scripts and references it only reads on demand.
Security scan A 0 findings. A grade says what 26 rules found in the file — not that it is safe. Third-party audits
  • NVIDIA SkillSpector warn 7 Sept 2026
SkillSpector: 3 findings, up to high

These are SkillSpector’s own severities. On a checked sample its high-severity flags on skills were ~96% false positives — a documented command, a public API, a “never do X” rule — so we show them as a caution to read, not a verdict. Why →

  • high Rogue Agent · line 45
    Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.
    Fix: Prevent the skill from modifying its own code, SKILL.md, or configuration files. Treat skill files as read-only at runtime.
  • medium Agent Snooping · line 46
    Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.
    Fix: Remove all code or instructions that list or read other skills' files or directories. Skills should operate independently; cross-skill access is a privilege escalation.
  • medium Excessive Agency · line 130
    Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
    Fix: Add human-in-the-loop confirmation for destructive, irreversible, or high-impact operations. Never auto-execute commands that modify files, send data, or alter system state.
How audits are shown
Origin original No closer match found in the catalogue.
Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

ModelPer sessionOnce invoked
Fable 5.1 $0.00087 $0.05202
Opus 5.5 $0.00035 $0.02081
Sonnet 5.5 $0.00017 $0.01040
Haiku 4.5 $0.00009 $0.00520

Measured 1mo ago against content hash 536055b65c4b, method: parsed. Prices are Anthropic first-party input rates as of 2026-10-07, from the pricing page.

Security

Grade A, and why

update-engine scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 1mo ago.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Nothing flagged

None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.

.claude/skills/update-engine/SKILL.md · 322 lines

How it starts

The opening of the file, as written. The whole thing — 322 lines — stays where its author put it; the contents beside it link to each section on GitHub.

/update-engine — Upgrade your brain's engine (opt-in, non-destructive)

Brain-side skill. The engine is the machinery your brain runs on — the RAG search code (rag/), the launchers and the engine-owned scripts. This skill swaps it for a newer version pinned in the launcher you were generated from, without ever touching what is yours: your notes, .env, constitution (CLAUDE.md), .claude/settings.json, your own skills and any engine skill you tailored are left byte-for-byte unchanged.

⚠️ This is a thin conversational driver. All the real, testable work lives in the deterministic core scripts/update-engine.mjs (ADR 0016). This skill only confirms with the user, runs the core, and reports — it holds no logic of its own.

When to use it

  • The user asks to update / upgrade their brain's engine ("update your engine", "is there a new version of my brain?").
  • Proactively: because the engine is observable (it records its version + where to pull from in engine-manifest.json), you may offer an update — but never run it without the user's explicit go-ahead, and never offer one blind: the read-only --check in Step 1 is what turns "there might be something" into "here is what it is".

Reporting the current version? The engine version is the brain's pinned git TAG — the manifest's source.ref (surfaced as the "Version" line of vault_stats and on the status-line), not the rag X.Y.Z / index-schema "internal build" numbers (ADR 0017).

Golden rule — OPT-IN, NEVER automatic

Do not run the core until the user has clearly confirmed. An engine update changes code on disk and may trigger a reindex; it must always be a conscious, accepted action.

What it touches vs NEVER touches

Updated (engine-owned) NEVER touched (yours)
rag/ search code + deps your notes (the whole vault/)
rag/launch.*, scripts/run-node.* launchers .env (your keys)
engine scripts (auto-commit, auto-push, status-line, verify-rag) CLAUDE.md (your constitution)
update-engine itself (it self-updates) .claude/settings.json
missing engine skills (e.g. local-mirror) — added if absent (ADR 0025) your own skills (.claude/skills/**): the engine never declared them, so it can never write them
engine skills you never edited: brought up to date (ADR 0026 §8) any engine skill you tailored: kept byte-for-byte, with the engine's newer version dropped beside it as .new — and offered to you as a choice (Step 4), never silently
missing engine MCP servers in .mcp.json — added if absent (ADR 0025) any server you added yourself to .mcp.json

Read the full file on GitHub · 322 lines

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

  1. 1mo ago Changed · +46 lines 536055b65c4b
  2. 2mo ago First seen · 276 lines · 87 tokens per session scan A ab236b2a864c

Subscribe to this mod's changes

update-engine is a skill published in the GitHub repository tpierrain/kenjaku (96 stars, last pushed 1mo ago), licensed Apache-2.0. It adds 87 tokens to every session and 5,202 once invoked, about $0.0003 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.

DeterministicMemory and contextdeterministic-aiinstallerllm-wikipersonal-assistantsecond-brain
Related

update-engine compared with skills from other repositories

update-engine next to 6 skills from other repositories
ModTypeStarsLast pushLicenceScanTokensWorks with
update-enginetpierrain/kenjakuSkill961mo agoApache-2.0A87Claude Code
refresh-contextjohnfkoo951/cmds-llm-wikiSkill10216d agononeA51Claude Code, Codex
brain-queryHAR5HA-7663/graphify-starterSkill21mo agononeA99Claude Code, Codex
wiki-queryHAR5HA-7663/graphify-starterSkill21mo agononeA61Claude Code, Codex
obsidian-basesAgriciDaniel/claude-obsidianSkill16k12d agoMITA75Claude Code
wiki-retrieveAgriciDaniel/claude-obsidianSkill16k12d agoMITA81Claude Code
wiki-foldAgriciDaniel/claude-obsidianSkill16k12d agoMITA76Claude Code