New: 97,000+ skills indexed from GitHub repos with 100+ stars · every skill safety-checkedBrowse top skillsTop skills
Esc to closeBrowse all skills
Submit a skillBrowse skills
Submit a skillBrowse skills

Agent skill

Security Updates

by SmilyOrg in SmilyOrg/photofield

Check and apply security updates across the photofield project (api/Go, ui/npm, docs/npm, e2e/npm).

MITAuto-check passedTesting & QA

Install Security Updates

skills CLI
$ npx skills add SmilyOrg/photofield --skill security-updates -a claude-code

Project install by default; add -g for ~/.claude/skills/.

GitHub CLI
$ gh skill install SmilyOrg/photofield security-updates --agent claude-code

Project scope by default; add --scope user for a personal install. Needs GitHub CLI 2.90.0 or later (public preview).

Manual copy
$ git clone --depth 1 https://github.com/SmilyOrg/photofield.git skills-src && mkdir -p .claude/skills && cp -r skills-src/.agents/skills/security-updates .claude/skills/security-updates && rm -rf skills-src

Use ~/.claude/skills/ instead of .claude/skills for a personal install. The folder must contain SKILL.md.

Claude Code skills documentation · loads skills from .claude/skills/

Facts

Skill name
security-updates
GitHub stars
608
Token cost
~808 tokens
SKILL.md length
214 words
Files
1
Skills in repo
3
Repo updated
First seen
Licence
MIT

At a glance

Check and apply security updates across the photofield project (api/Go, ui/npm, docs/npm, e2e/npm).

  • Works in 6 steps: Scan current state → Apply updates per area → Build verification → …
  • The user asks to update dependencies
  • SKILL.md covers Process and Important Notes
  • Calls npm, go and git

What it does

Security Updates is an agent skill from SmilyOrg/photofield. Check and apply security updates across the photofield project (api/Go, ui/npm, docs/npm, e2e/npm). Use when the user asks to update dependencies, patch vulnerabilities, run a security audit, or check for breakage from version upgrades.

Its SKILL.md is about 810 tokens, which your agent loads only when the skill is triggered. It is a single SKILL.md file with no bundled scripts.

It sits in Testing & QA, covering End-to-end testing, Code migrations and Security review. It works with npm, Go and Vue.js. The repository describes itself as: A self-hosted non-invasive single-binary photo gallery with a focus on speed and simplicity. The licence is MIT.

When your agent uses it

  • The user asks to update dependencies
  • Patch vulnerabilities
  • Run a security audit
  • Check for breakage from version upgrades

Example prompts

  • “/security-updates”

Requirements

  • Node.js

Workflow steps

6 steps, taken from the step headings in SKILL.md.

  1. Scan current state
  2. Apply updates per area
  3. Build verification
  4. Final audit report
  5. Commit
  6. Document remaining vulnerabilities

What it can do on your machine

Read from SKILL.md and the folder at commit ea0c7c9. It shows what the files ask for, not the result of running them.

  • Tool permissions

    Pre-approves nothing: there is no allowed-tools line, so your agent's usual permission prompts apply.

    From allowed-tools in the SKILL.md frontmatter.

  • Runs code

    Shell commands in SKILL.md call:

    • npm
    • go
    • git
    • npx

    From the folder's file list and the shell code blocks in SKILL.md.

  • Network

    No URLs in SKILL.md. Its commands use npm, git and npx, which can reach the network depending on how they are called.

    From URLs in SKILL.md, links to its own repository left out.

  • Credentials

    Names no API keys, tokens, secrets or passwords.

    From names ending in _API_KEY, _TOKEN, _SECRET, _KEY or _PASSWORD in SKILL.md.

Context cost

Security Updates loads about 808 tokens when it runs. Until then it costs about 63 tokens; SKILL.md has 214 words of instructions outside code blocks.

Always · name and description, kept in context so the agent knows when to use it
~63
When it runs · the whole SKILL.md, loaded when a task matches
~808

Estimates: characters ÷ 4, the usual rule of thumb; real counts depend on the model's tokenizer. Scripts and assets cost tokens only if the agent reads them.

Safety

Auto-check passed

The automated check found no risky patterns in SKILL.md.

Automated static check — not a guarantee. Review scripts before installing. It scans the text of SKILL.md for risky patterns (piping downloads into a shell, reading credential files, hidden Unicode, destructive commands); files beside SKILL.md are not scanned.

SKILL.md

The full file from SmilyOrg/photofield at commit ea0c7c9, republished under its MIT licence (© SmilyOrg). 214 words, ~808 tokens.

Download SKILL.mdSave it as .claude/skills/security-updates/SKILL.md (or your agent's skills folder).
name
security-updates
description
Check and apply security updates across the photofield project (api/Go, ui/npm, docs/npm, e2e/npm). Use when the user asks to update dependencies, patch vulnerabilities, run a security audit, or check for breakage from version upgrades.
version
1.0.0
platforms
linux

Security Updates for Photofield

The project has four dependency trees to audit:

AreaTypePackage File
apiGogo.mod / go.sum
uinpmui/package.json
docsnpmdocs/package.json
e2enpme2e/package.json

Process

Step 1: Scan current state
bash
go version
govulncheck ./... 2>&1
cd ui && npm audit 2>&1
cd ../docs && npm audit 2>&1
cd ../e2e && npm audit 2>&1

Record before-counts for the final report.

Step 2: Apply updates per area
API (Go)
bash
cd <root>
go get -u go
go get -u ./...
go mod tidy
govulncheck ./... 2>&1 | grep -E "(vulnerabilit|affected)"
  • Go stdlib upgrades require toolchain goX.Y.Z in go.mod to auto-download.
UI / Docs / E2E (npm)
bash
cd <area>
npm audit 2>&1
npm install <pkg>@latest

If transitive dependencies (e.g. esbuild, postcss, rollup) have vulns with no fix in their own tree, add an overrides field to package.json:

json
"overrides": { "<package>": "<version>" }

Always run npm audit again to verify.

Step 3: Build verification

All areas must build cleanly:

bash
go build ./... && go test ./... -short 2>&1
cd ui && npx vite build 2>&1
cd ../docs && npx vitepress build 2>&1
cd ../e2e && npx playwright test 2>&1

Non-blocking warnings to ignore:

  • govulncheck reporting vulns in imported packages not called by code
  • Chunk size warnings
  • Tree-shaking annotation warnings from transitive dependencies
Step 4: Final audit report
bash
echo "=== API ==="; go version && govulncheck ./... 2>&1 | grep -E "(vulnerabilit|affected|No vulnerabilities)"
echo "=== UI ==="; cd ui && npm audit 2>&1
echo "=== DOCS ==="; cd ../docs && npm audit 2>&1
echo "=== E2E ==="; cd ../e2e && npm audit 2>&1

Report as a table:

| Area | Before | After | Status |
|------|--------|-------|--------|
| API (Go) | X | Y | ✅/⚠️ |
| UI (npm) | X | Y | ✅/⚠️ |
| DOCS (npm) | X | Y | ✅/⚠️ |
| E2E (npm) | X | Y | ✅/⚠️ |
Step 5: Commit
bash
cd <root>
git add -A
git status
git diff --cached --stat
git commit -m "chore: apply security updates"

One commit per logical change (e.g. one for Go, one for npm areas).

Step 6: Document remaining vulnerabilities

For any vulns that could not be fixed, note why:

markdown
| Area | Vulns | Reason |
|------|-------|--------|
| UI | 1 low | Upstream — latest package version has no patch |
| Docs | 3 | Locked by transitive dependency chain — fix in newer major version |

Important Notes

  • Always run govulncheck and all builds after changes.
  • Work on the security-update branch.
  • Accept breaking API changes in tests or build tools when they resolve critical vulns.
  • Document unfixable vulns and whether a newer major version (alpha/beta) resolves them — but do not upgrade to alpha/beta unless explicitly requested.

© SmilyOrg, MIT. Rendered from Markdown: HTML in the file is shown as text, images as links, and headings moved down two levels. Raw file

Files

Just SKILL.md in .agents/skills/security-updates of SmilyOrg/photofield.

Open the folder on GitHubat commit ea0c7c9

Compare with similar skills

Security Updates next to the 5 skills that share the most tags, products or categories with it. Stars are the repository's; “used in” counts other GitHub owners with a copy.

Security Updates compared with similar skills
SkillStarsUsed inTokensAuto-checkLicenceRepo updated
Security Updates this skillSmilyOrg/photofield608—~808Automated safety check: PassMIT
Time Aware Dependency Cve ScannerArabelaTso/Skills-4-SE253—~2.1kAutomated safety check: PassApache-2.0
Testing StrategyAnastasiyaW/codex-claude-code-config154—~2kAutomated safety check: PassMIT
OpenHarness End-to-End EvalsHKUDS/OpenHarness16k1 repos~2.1kAutomated safety check: NotesMIT
Qwen Code E2E TestingQwenLM/qwen-code28k—~2.1kAutomated safety check: PassApache-2.0
Go Redis Client Test Runnerredis/go-redis22k—~786Automated safety check: PassBSD-2-Clause

Similar skills

  • Time Aware Dependency Cve Scanner

    ArabelaTso/Skills-4-SE

    Scan repositories for newly disclosed CVEs in dependencies after a specific cutoff date.

    253 GitHub stars~2.1k tokensUpdated 1 mo ago
    SecurityAuto-check passed

  • Testing Strategy

    AnastasiyaW/codex-claude-code-config

    A skill your agent uses when planning or reviewing tests for a code change, choosing between unit, focused regression, integration, contract, end-to-end, performance, security, property-based, or…

    154 GitHub stars~2k tokensUpdated 5 days ago
    Testing & QAAuto-check passed

  • OpenHarness End-to-End Evals

    HKUDS/OpenHarness

    Validates OpenHarness features by running real multi-turn agent loops with live LLM calls against an unfamiliar codebase, checking actual tool execution.

    16k GitHub starsUsed in 1 repo~2.1k tokens
    Testing & QAAuto-check: notes

  • Qwen Code E2E Testing

    QwenLM/qwen-code

    Guides end-to-end testing of the Qwen Code CLI in headless mode with real model calls, MCP test servers and inspection of raw API traffic.

    28k GitHub stars~2.1k tokensUpdated today
    Testing & QAAuto-check passed

  • Go Redis Client Test Runner

    redis/go-redis

    Official

    Explains how to run go-redis tests: the Docker Compose stack, make targets, focusing a single Ginkgo spec, the e2e suite and the version environment variables.

    22k GitHub stars~786 tokensUpdated yesterday
    Testing & QAAuto-check passed

  • E2E Testing

    InsForge/InsForge

    A skill your agent uses when an InsForge maintainer has finished an OSS repo change and is ready to open, update, or submit the InsForge PR.

    13k GitHub stars~1.5k tokensUpdated today
    Testing & QAAuto-check passed

More from SmilyOrg/photofield

  • Local Dev

    SmilyOrg/photofield

    Run, test, and debug the photofield server locally. An agent skill from SmilyOrg/photofield.

    608 GitHub stars~2.4k tokensUpdated 1 mo ago
    Auto-check passed

  • Release

    SmilyOrg/photofield

    Follow the Photofield release process: batch changelog entries, create the release commit and tag, and push.

    608 GitHub stars~1.6k tokensUpdated 1 mo ago
    Auto-check passed

Works with

Categories

Questions about Security Updates

What does Security Updates do?

Check and apply security updates across the photofield project (api/Go, ui/npm, docs/npm, e2e/npm). Security Updates is an agent skill from SmilyOrg/photofield. Check and apply security updates across the photofield project (api/Go, ui/npm, docs/npm, e2e/npm).

When should I use Security Updates?

Security Updates fits situations like: the user asks to update dependencies; patch vulnerabilities; run a security audit; check for breakage from version upgrades.

How do I install Security Updates in Claude Code?

Run `npx skills add SmilyOrg/photofield --skill security-updates -a claude-code`. Or copy the skill folder (.agents/skills/security-updates in SmilyOrg/photofield) into .claude/skills/security-updates in your project. Claude Code loads it when a task matches its description.

How do I install Security Updates in Codex?

Run `npx skills add SmilyOrg/photofield --skill security-updates -a codex`. Or copy the skill folder (.agents/skills/security-updates in SmilyOrg/photofield) into .agents/skills/security-updates in your project. Codex loads it when a task matches its description.

Can I use Security Updates in Cursor, Gemini CLI or GitHub Copilot?

Cursor, Gemini CLI, GitHub Copilot and OpenCode also load SKILL.md folders. With the skills CLI, run `npx skills add SmilyOrg/photofield --skill security-updates -a cursor` (or -a gemini-cli, github-copilot or opencode for the others). To copy it by hand, put the folder in .cursor/skills/security-updates, .gemini/skills/security-updates, .github/skills/security-updates and .opencode/skills/security-updates in your project.

What does Security Updates need to run?

Going by SKILL.md and its folder, Security Updates needs the command-line tools its instructions call (npm, go, git and npx). Our summary lists: Node.js.

Does Security Updates access the network?

SKILL.md contains no URLs. Its commands use npm, git and npx, which can reach the network depending on how they are called. This is read from the text; nothing was executed.

Is Security Updates safe to install?

Our automated static check of SKILL.md found no risky patterns, such as piping downloads into a shell, reading credential files or hidden Unicode. It is not a guarantee. Review the folder before installing.

What licence does Security Updates use?

Security Updates is published under the MIT licence (the repository's licence). It allows redistribution, so the full SKILL.md is shown on this page.

How many tokens does Security Updates use?

About 808 tokens (SKILL.md is roughly 3.2k characters). Agents keep only the skill's name and description in context until a task matches; then they load SKILL.md in full.

What are the alternatives to Security Updates?

Skills that share tags, products or a category with Security Updates: Time Aware Dependency Cve Scanner (ArabelaTso/Skills-4-SE, 253 stars), Testing Strategy (AnastasiyaW/codex-claude-code-config, 154 stars), OpenHarness End-to-End Evals (HKUDS/OpenHarness, 16k stars) and Qwen Code E2E Testing (QwenLM/qwen-code, 28k stars). The comparison table on this page puts their stars, adoption, token cost, safety result and licence side by side.

Who maintains Security Updates?

SmilyOrg (a GitHub user) maintains it in SmilyOrg/photofield, which has 608 GitHub stars. The repository holds 3 skills in this directory. The repository was last updated on August 17, 2026.

Source: SmilyOrg/photofield on GitHub. Facts on this page come from the repository at the commit we read; the author's words are quoted as theirs.