Install
$ agentstack add skill-sergeyitaly-claude-skill-deployer-skill-official-updater ✓ scanned · ✓ verified — works with Claude Code, Cursor, and more.
Security review
✓ PassedNo issues found. Passed automated security review. · v0.1.0 How review works →
- ✓ Prompt-injection patterns
- ✓ Secret / credential exfiltration
- ✓ Dangerous shell & filesystem operations
- ✓ Untrusted network calls
- ✓ Known-malicious package signatures
What it can access
- ✓ Network access No
- ✓ Filesystem access No
- ✓ Shell / process execution No
- ✓ Environment & secrets No
- ✓ Dynamic code execution No
From automated source analysis of v0.1.0. “Used” means the capability is present in the source — more access means more to trust, not that it’s unsafe.
About
Official Anthropic Skills Updater
Keeps a local copy of Anthropic's official skills (https://github.com/anthropics/skills, under skills/) in sync with this repo's skills_library/, without silently overwriting unrelated or hand-edited skills.
State file
skills_library/.official-skills-state.json (create if missing):
{
"repoSha": "",
"skills": {
"pdf": "",
"docx": ""
}
}
Only skill names listed under skills are "managed" by this updater - a same-named skill in skills_library/ that ISN'T listed there is assumed to be a hand-written/customized skill and must never be overwritten without an explicit user decision.
1. Cheap check (every session)
Automation: When the Claude Skills extension is active and this workspace has skills_library/, it installs a Claude Code SessionStart hook (official-skills-watch.js) that runs the check below on startup, resume, and clear. If updates exist, the hook injects context telling you to read this skill and sync immediately — do not ask the user which skills to pull.
Manual / fallback (same logic):
git ls-remote https://github.com/anthropics/skills.git HEAD
Compare the returned SHA to repoSha in the state file (treat a missing file as "no state yet"). If unchanged, say nothing further - this step should be silent and near-instant.
VS Code: Claude Skills: Check Official Anthropic Skill Updates runs the same check from the Command Palette. Enable Official Skills Session Check re-installs the SessionStart hook if needed.
2. When the repo SHA has changed (or no state file yet)
List the current skill directories upstream:
gh api repos/anthropics/skills/contents/skills --jq '.[].name'
For each upstream skill name, compare against skills_library/:
- New - upstream name not present locally: candidate to add.
- Managed + changed - name is in the state file's
skillsmap AND
git log -1 --format=%H -- skills/ (in a shallow clone, see below) differs from the stored SHA: candidate to update.
- Unmanaged - a local skill with the same name exists but isn't in the
state file's skills map: skip, and report it as "name collision, not touched" so the user is aware but nothing changes automatically.
Auto-sync policy (default — do not ask the user):
- Pull every
newandmanaged + changedcandidate automatically. - Never overwrite an
unmanagedcollision (same local name, not in state
skills map) — list those in the completion summary only.
- Do not stop to ask "which skills" or "all 17?" — proceed with the sync
unless git/gh is unavailable or the sparse clone fails.
Briefly note what you are syncing (counts + names), then run the pull.
3. Pulling skills (all actionable candidates)
Use a temporary shallow sparse clone so only the needed skill directories are fetched. On Windows, do not pass -q to git sparse-checkout set.
git clone --depth 1 --filter=blob:none --sparse https://github.com/anthropics/skills.git
cd
git sparse-checkout set skills/ skills/ ...
For each actionable skill (new or managed + changed), copy /skills// to skills_library//. Delete `` afterwards.
To record per-skill SHAs for managed skills, after checkout run git log -1 --format=%H -- skills/ inside `` for each synced skill.
4. Manifest entries
For each newly added skill, add an entry to skills_library/manifest.json:
description: the skill's SKILL.md frontmatterdescription, trimmed to
one line (unwrap YAML |- blocks to a single line).
detect_globs: use the table below; do not ask the user.
| Skill | detect_globs | |---|---| | docx | ["**/*.docx"] | | pptx | ["**/*.pptx"] | | xlsx | ["**/*.xlsx", "**/*.xlsm", "**/*.csv", "**/*.tsv"] | | pdf | ["**/*.pdf"] | | webapp-testing | ["**/package.json", "**/playwright.config.*", "**/vite.config.*"] | | mcp-builder | ["**/mcp*.json", "**/*mcp*", "**/package.json"] | | claude-api | ["**/*.py", "**/*.ts", "**/*.js", "**/package.json"] | | skill-creator | ["**/.claude/skills/**", "**/skills_library/**", "**/SKILL.md"] | | all other official skills | ["**/*"] |
For updated skills, refresh the manifest description if the upstream frontmatter changed meaningfully.
5. Update state and finish
- Write the new
repoShaand per-skill SHAs (for every skill added or
updated) to skills_library/.official-skills-state.json.
- If
extension/exists, runnpm run sync-skillsinsideextension/to
refresh the bundled copy (or tell the user if you cannot run commands).
- Summarize what was synced: added count, updated count, skipped collisions.
- If this workspace uses the deployer extension, note that **Install Skill
Library** (or py generate_skills.py install) republishes to ~/.claude/skills/ — run or suggest only if skills were actually changed.
6. No git/gh available
If neither git nor gh is available, say so and stop - don't attempt to fetch individual files via raw URLs as a substitute, since that won't reliably capture a skill's full directory (scripts, references, assets).
Source & license
This open-source skill is cataloged on AgentStack and links to its original source — we do not rehost the code.
- Author: sergeyitaly
- Source: sergeyitaly/claude-skill-deployer
- License: MIT
Install and usage instructions live in the source repository linked above.
Reviews
No reviews yet — be the first.
Write a review
Versions
- v0.1.0 Imported from the upstream source.