Install
$ agentstack add skill-microsoft-shadowfrog-shadow-frog-update ✓ scanned · ✓ verified, works with Claude Code, Cursor, and more.
Security review
✓ PassedNo issues found. Passed automated security review. · v0.1.0 How review works →
- ✓ Prompt-injection patterns
- ✓ Secret / credential exfiltration
- ✓ Dangerous shell & filesystem operations
- ✓ Untrusted network calls
- ✓ Known-malicious package signatures
What it can access
- ✓ Network access No
- ✓ Filesystem access No
- ✓ Shell / process execution No
- ✓ Environment & secrets No
- ✓ Dynamic code execution No
From automated source analysis of v0.1.0. “Used” means the capability is present in the source — more access means more to trust, not that it’s unsafe.
Verified badge
Passed review? Show it. Paste this badge into your README, it links to the public security report.
Reliability & compatibility
Declared compatibility
Compatibility is declared by the source manifest. End-to-end runtime verification is coming, see below.
We're building live execution health for every listing: tool-call success rate, median latency, uptime, and last-checked timestamps, measured, not self-reported. It isn't live yet, so we don't show numbers we can't stand behind.
How agent discovery & health will work →About
ShadowFrog Update
Updates .shadow/ from two sources: code changes (git diff) and conversational knowledge (what the user said during the session). Prerequisite: .shadow/ exists.
Triggers
- Hook reminder:
preToolUseinjects a staleness warning when
.shadow/_meta/state.json#last_commit differs from HEAD. The hook only reminds — it does NOT auto-run update.
- Manual: user invokes
/shadow-frog-update
Phase 1: Detect Changes
# Read last_commit defensively: it may be missing, or the literal "none"
# when init ran without git (e.g. inside a container). `git diff none HEAD`
# would abort with "fatal: bad revision 'none'", and a missing key would
# make $LAST_COMMIT empty so `git diff HEAD` silently reports the wrong set.
LAST_COMMIT=$(python3 -c "import json,sys; print(json.load(sys.stdin).get('last_commit','none'))" /dev/null || echo "none")
if git rev-parse --verify "$LAST_COMMIT" >/dev/null 2>&1; then
git diff --name-only "$LAST_COMMIT" HEAD # committed changes since last update
else
echo "WARNING: state.json has no usable last_commit — falling back to a full re-scan."
fi
git diff --name-only HEAD # uncommitted changes
git diff --name-only --cached # staged changes
Categorize: modified, added, deleted, renamed.
Phase 2: Update Per-File Shadows (Symbol-Level)
For each changed file, update its shadow at the symbol level:
- Added symbols → add new
##section - Removed symbols → mark section as
REMOVED, keep discoveries for history - Renamed symbols → update heading, preserve discoveries
- Modified symbols → check if discoveries still hold
Lightweight update (auto/hook): re-extract symbols, update headings, flag stale. Deep update (manual/dream): read diffs, generate new discoveries, verify existing ones.
Phase 3: Capture Conversational Knowledge
When the user shares knowledge during the session, write it immediately. Do not batch for later.
Signals to capture:
| Signal | Example | Category | |--------|---------|----------| | Warning | "Don't change the retry logic, it's subtle" | warning | | Design intent | "We use this pattern because the API is unreliable" | intent | | History | "We tried caching here but it caused stale reads" | history | | Gotcha | "This looks wrong but matches the tax authority spec" | warning | | Deprecation | "This module is being replaced by v2/" | intent | | Contract | "The 30s timeout matches our SLA" | contract | | Convention | "Always use the helper in utils.py, not raw SQL" | convention |
Write as:
-
_(verified, source: user)_
For knowledge emerging from collaborative work (debugging, refactoring, test failures):
-
_(verified, source: interaction)_
Anchor to the specific file::symbol. source: user and source: interaction are always verified.
Auto-Placement
Users will not specify where to store their knowledge. You must find the correct location. Procedure:
- Parse the user's statement for code references — file names, function names,
class names, module names, variable names, error messages, CLI flags.
- If the knowledge is a project-wide preference or convention with no code
references (e.g., "always use snake_case", "no backward compatibility", "prefer small PRs") → write to _prefs.md.
- If explicit references found → look up those
file::symbolpaths in
_index.md and the corresponding shadow files.
- If no explicit references → use context:
- What file is the user currently viewing or editing?
- What files were recently modified in this session?
- Search shadow files:
grep -rl "" .shadow/ --include="*.md"
- If multiple candidate locations → pick the most specific symbol that the
knowledge applies to. Prefer a single file::symbol over file-level.
- If the knowledge spans 3+ files → create a
_cross/.md
entry and add back-pointers to each involved file's ## Cross-References. For 2-file discoveries, use per-file entries with Also involves: instead.
- If no matching location exists (e.g., the user mentions a concept not yet in
the shadow) → place at the file-level ## File-Level section of the most relevant file, or create a new _cross/ entry for repo-wide knowledge.
Never ask the user "where should I put this?" — always resolve placement yourself.
Phase 4: Extract Session Insights
At session end or manual trigger, review the session for:
- Files modified and why
- Patterns revealed by the changes
- Unrecorded conversational knowledge (user statements not yet shadowed)
- Cross-cutting discoveries (create in
_cross/.mdif 3+ files involved)
Phase 5: Handle Structural Changes
Added files:
- Check
.shadow/.shadowignore— skip if the file matches an ignore pattern - Create
.shadow//.mdwith symbol-organized template - Add
## Cross-Referencessection - Add to
_index.md
Deleted files:
- Add
ORPHANEDmarker to shadow header - Keep shadow (discoveries explain history)
- Mark
[REMOVED]on any_cross/refs pointing to this file - Update
_index.md
Renamed files:
- Move
.shadow/.mdto.shadow/.md - Update all
_cross/**Refs**:entries (old path → new path) - Update all
Also involves:in other per-file shadows - Update
_index.md - Preserve all discoveries
Phase 6: Verify and Dedup
Follow the dedup and writing rules in /shadow-frog — read before write, merge or update existing entries, fix bad format in place.
Verify exploration discoveries using the observe-based or do-based methods in /shadow-frog § Verification. source: user and source: interaction → always verified; only re-verify if the underlying code changes.
Phase 7: Verify Reference Integrity
Check the five core invariants (full 7-invariant set in /shadow-frog):
- Every
_cross/.mdref has a back-pointer in per-file## Cross-References - Every
## Cross-Referencesentry has a corresponding_cross/.md - No duplicate cross-cutting filenames
- All
Also involves:usefile::symbolnotation - No duplicate discoveries (same behavioral claim at same symbol)
Repair any violations before proceeding.
Phase 8: Update Metadata
Preserve dream_cycles_completed from the existing state — only dream-reconcile.py increments it.
{
"version": 1,
"initialized_at": "",
"last_update_at": "",
"last_commit": "",
"last_update_type": "init|auto|manual|dream|meditate",
"total_files": N,
"total_symbols": N,
"total_discoveries": N,
"dream_cycles_completed":
}
Refresh _index.md with current counts.
Discovery Writing Rules
See /shadow-frog § Discovery Format for the verbatim per-file, cross-cutting, and preference formats. Rules to keep in mind during update sessions:
- Be behavioral: "silently returns None on expired tokens" not "handles token expiration"
source: userandsource: interaction→ alwaysverified, use user's own wordssource: exploration→ markuncertainunless verified by code reading or tests- If 3+ files involved → create in
_cross/.mdinstead, add back-pointers - If project-wide preference with no file reference → write to
_prefs.md - Slug naming: kebab-case derived from title (e.g., "Token expiry config split" →
token-expiry-config-split.md)
Staleness Rules
- Symbol modified → check if discovery still holds
- Symbol renamed → move discoveries to new heading
- Symbol removed → mark section
REMOVED, keep discoveries source: userdiscoveries → only mark stale if symbol completely removed
Source & license
This open-source skill is cataloged on AgentStack and links to its original source — we do not rehost the code.
- Author: microsoft
- Source: microsoft/ShadowFrog
- License: MIT
Install and usage instructions live in the source repository linked above.
Reviews
No reviews yet, be the first.
Write a review
Versions
- v0.1.0 Imported from the upstream source.