Install
$ agentstack add skill-fabioespindula-awesome-nanoclaw-skills-awesome-updater ✓ scanned · ✓ verified — works with Claude Code, Cursor, and more.
Security review
✓ PassedNo issues found. Passed automated security review. · v0.1.0 How review works →
- ✓ Prompt-injection patterns
- ✓ Secret / credential exfiltration
- ✓ Dangerous shell & filesystem operations
- ✓ Untrusted network calls
- ✓ Known-malicious package signatures
What it can access
- ✓ Network access No
- ✓ Filesystem access No
- ✓ Shell / process execution No
- ✓ Environment & secrets No
- ✓ Dynamic code execution No
From automated source analysis of v0.1.0. “Used” means the capability is present in the source — more access means more to trust, not that it’s unsafe.
Verified badge
Passed review? Show it. Paste this badge into your README — it links to the public security report.
Reliability & compatibility
Declared compatibility
Compatibility is declared by the source manifest. End-to-end runtime verification is coming — see below.
We're building live execution health for every listing: tool-call success rate, median latency, uptime, and last-checked timestamps — measured, not self-reported. It isn't live yet, so we don't show numbers we can't stand behind.
How agent discovery & health will work →About
Awesome Updater
Use this skill to install and keep Awesome NanoClaw Skills up to date.
The updater is intentionally central: individual skills should not each reimplement update logic. Installed skills carry a .awesome-skill.json metadata file, and this skill's script reads that metadata to check for content-level skill updates, discover newly added first-party skills, apply updates, and preserve rollback backups.
Defaults
update_check:trueauto_upgrade:truediscover_new:truebranch:main- hash algorithm:
sha256over exact skill file bytes and normalized relative paths - update throttle: one update check per skill per hour unless
--forceis used - discover throttle: one package-wide discover per hour unless
--forceis used
Auto-upgrade and first-party discovery are on by default for security: fixes to unsafe instructions, dependencies, validation logic, install procedures, or newly published curated skills should reach installed agents without requiring manual action.
Update decisions are based on the managed skill's content hash, not only on the repository commit. A repository commit that changes another skill should update last_seen_commit provenance but must not replace or back up an unchanged skill.
Help Mode
If the user invokes /awesome-updater help, /awesome-updater examples, or asks how to use this skill, explain usage instead of installing, checking, or configuring anything.
The help response should include:
- what Awesome Updater does;
- when to use it;
- what it can modify;
- command forms for install, discover, check, config, and
/nanoskills updates; - what input the user should provide;
- what output the user gets;
- curated examples;
- contextual examples when the visible conversation includes a useful skill name or runtime skills directory.
Curated examples:
/awesome-updater help/nanoskills updates/awesome-updater discover/awesome-updater check feba-board
Safety Model
Before replacing a skill, the updater:
- acquires a lock so only one update runs at a time
- verifies the source skill exists and contains
SKILL.md - rejects symlinks in the source skill
- backs up the installed skill under
.awesome-backups/ - copies the new skill into place
- writes updated
.awesome-skill.jsonmetadata withmetadata_version: 2,hash_algorithm: sha256,installed_hash, andlast_seen_hash - restores the backup if replacement fails
The updater only manages skills that contain .awesome-skill.json. If a skill has no metadata, do not auto-update it; install it through this updater first.
Discovery follows a trusted first-party package model: it syncs skills that are present in the configured Awesome NanoClaw Skills source repository. It does not install arbitrary third-party skills from unknown sources. Existing unmanaged skill folders are skipped instead of overwritten. Discovery is best-effort: if one skill update fails, that skill is restored from its own backup and other successful skill updates are kept.
Command Patterns
Bootstrap the updater into a NanoClaw runtime:
python3 scripts/awesome_skills.py install awesome-updater --source-dir /path/to/awesome-nanoclaw-skills --skills-dir /path/to/nanoclaw/container/skills
Install a skill into a NanoClaw runtime:
python3 scripts/awesome_skills.py install feba-board --source-dir /path/to/awesome-nanoclaw-skills --skills-dir /path/to/nanoclaw/container/skills
Discover newly added curated skills and check existing managed skills:
python3 scripts/awesome_skills.py discover --skills-dir /path/to/nanoclaw/container/skills
Check and auto-upgrade one installed skill:
python3 scripts/awesome_skills.py check feba-board --skills-dir /path/to/nanoclaw/container/skills --auto
Preview an update without writing metadata, backups, or skill files:
python3 scripts/awesome_skills.py check feba-board --skills-dir /path/to/nanoclaw/container/skills --auto --force --dry-run
Show read-only managed skill status:
python3 scripts/awesome_skills.py status --skills-dir /path/to/nanoclaw/container/skills --source-dir /path/to/awesome-nanoclaw-skills
Force a check, ignoring the one-hour throttle:
python3 scripts/awesome_skills.py check feba-board --skills-dir /path/to/nanoclaw/container/skills --auto --force
Change config for one installed skill:
python3 scripts/awesome_skills.py config feba-board --skills-dir /path/to/nanoclaw/container/skills --set auto_upgrade=false
Disable first-party skill discovery from the package config stored on awesome-updater:
python3 scripts/awesome_skills.py config awesome-updater --skills-dir /path/to/nanoclaw/container/skills --set discover_new=false
Preamble For Managed Skills
Managed skills can include this lightweight preamble before their normal workflow:
python3 /path/to/container/skills/awesome-updater/scripts/awesome_skills.py check awesome-updater --skills-dir /path/to/container/skills || true
python3 /path/to/container/skills/awesome-updater/scripts/awesome_skills.py discover --skills-dir /path/to/container/skills || true
python3 /path/to/container/skills/awesome-updater/scripts/awesome_skills.py check --skills-dir /path/to/container/skills || true
If the check or discover step fails because of network or GitHub availability, continue the original skill workflow. Update failures should not block normal use unless the user explicitly asked to update.
Output Rules
- Return the JSON summary from the script when the user asks for update status.
- Mention whether skills were discovered, already current, changed by content hash, would upgrade in dry-run, upgraded, throttled, skipped by config, skipped because unmanaged, or restored from backup.
- Treat
statusand--dry-runas read-only inspection. They must not write metadata, create backups, or replace skills. - Do not expose tokens or environment variables.
- Do not auto-update skills without
.awesome-skill.jsonmetadata.
Source & license
This open-source skill is cataloged on AgentStack and links to its original source — we do not rehost the code.
- Author: fabioespindula
- Source: fabioespindula/awesome-nanoclaw-skills
- License: MIT
- Homepage: https://awesome-nanoclaw-skills.vercel.app
Install and usage instructions live in the source repository linked above.
Reviews
No reviews yet — be the first.
Write a review
Versions
- v0.1.0 Imported from the upstream source.