update-skills

Stop losing track of where your Claude Code skills came from.

The problem

You've installed 30+ Claude Code skills. Some from GitHub. Some from gists. Some from that blog post you bookmarked but can't find again.

There's no pip list equivalent. No plugin marketplace. No update manager. Just a pile of SKILL.md files with no connection to their source. When a skill ships a bugfix, you won't know. Neither will Claude.

This is the gap between "it works" and "I can maintain it."

What this skill does

• Discovers the canonical GitHub repo for each of your manually installed skills
• Tracks the exact commit SHA of what you have installed vs what's upstream
• Updates any skill — or all of them — with one command
• Rolls back if an update breaks something
• Zero pip dependencies. No API keys needed for source resolution. You're not locked into anything.

Install

git clone https://github.com/pcx-wave/update-skills ~/.claude/skills/update-skills

Usage

Step 1 — Resolve sources (first time only)

Tell Claude to find where each skill originally came from:

"find the source repos for my skills"

Claude reads each SKILL.md, searches verbatim phrases on DuckDuckGo, and writes a .skill-source file per skill. No script, no token. Done once.

Step 2 — Check for updates

# Check all skills
python ~/.claude/skills/update-skills/scripts/check_updates.py

# Check a specific skill
python ~/.claude/skills/update-skills/scripts/check_updates.py --skill vibe

Compares local skill content against upstream (with GITHUB_TOKEN: SHA-by-SHA precision; without: content comparison via SKILL.md).

Step 3 — Update

# Update every outdated skill at once
python ~/.claude/skills/update-skills/scripts/update_skill.py all

# Update specific skills
python ~/.claude/skills/update-skills/scripts/update_skill.py vibe geo

Revert if something breaks

python ~/.claude/skills/update-skills/scripts/update_skill.py --revert vibe
python ~/.claude/skills/update-skills/scripts/update_skill.py --revert all

Previous versions are backed up automatically before each update.

How source resolution works

1. Reads verbatim phrases from the first 10 lines of each local SKILL.md
2. Searches DuckDuckGo: github <skill-name> <verbatim phrase>
3. For each candidate repo found, fetches the first 10 lines of the remote SKILL.md
4. Rejects candidates where no sentence matches verbatim — eliminates forks and similarly-named but different skills
5. Writes a .skill-source file so this is a one-time cost per skill

.skill-source format

Each resolved skill directory gets a hidden JSON file:

{
  "repo": "owner/repo",
  "path": "skills/vibe",
  "confidence": "unique",
  "last_sha": "a1b2c3d4e5f6789abcdef1234567890abcdef12",
  "previous_sha": "9f8e7d6c5b4a3210fedcba9876543210fedcba98"
}

GITHUB_TOKEN — optional

Both modes work out of the box. The difference is precision and rate limits.

	Without token	With GITHUB_TOKEN
Detection	SKILL.md content comparison	Exact commit SHA comparison
Misses	Updates that don't touch SKILL.md	Nothing
Rate limit	60 GitHub API req/hour — inconsistent if run repeatedly	5000/hour — no practical limit

To add a token permanently: echo 'export GITHUB_TOKEN=<token>' >> ~/.bashrc

Requirements

• Python 3.10+ — no pip dependencies, no virtualenv, no node_modules