ops-update — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited ops-update (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Upgrades the local claude-ops plugin to the newest version published in the ops-marketplace catalogue, then leaves the box clean: no stale cache dirs, no dangling version-pinned paths.
The workhorse is `${CLAUDE_PLUGIN_ROOT}/bin/ops-update`. It runs a 9-step loop:
claude plugin marketplace update ops-marketplace (git-pulls the clone).marketplace.json (or --to X.Y.Z).claude plugin update ops@ops-marketplace, with a force-reinstall fallback (rm cache + claude plugin install) for the Claude Code bug where update reports "already latest" while the cache stays stale (anthropics/claude-code#61954).scripts/cache-patches/ against the new cache (empty when all fixes are upstream — the desired state).cache/ops-marketplace/ops/<ver>/ except the new one.cache/.../ops/<oldver>/ paths in live configs/scripts/systemd units only (never logs, memory, or transcripts — those use ${CLAUDE_PLUGIN_ROOT} at runtime so they self-resolve).ops-post-update-migrate (idempotent, per-version). It also maintains a stable cache/.../ops/current/ directory (rsynced from the new version and repointed in installed_plugins.json) so Claude Code GC'ing the old versioned dir mid-session never causes "Plugin directory does not exist" hook errors.~/Projects, fast-forwards its main to origin/main so a dev clone never silently drifts behind the published release. Acts only on a clean main (never clobbers uncommitted WIP, a feature branch, or unpushed commits); a no-op when no checkout exists. Skip with --no-localsync./reload-plugins is needed to load it.Steps 5–6 are destructive (prune + rewrite), so always dry-run first, show the plan, confirm, then apply (Rule 5).
${CLAUDE_PLUGIN_ROOT}/bin/ops-update --dry-runPresent the output: current → target version, which cache versions would be pruned, which files would be rewritten. If the dry-run shows already on <ver> and nothing to prune/rewrite, tell the user the box is already current and stop (offer --force only if they suspect a stale cache).
Use AskUserQuestion before applying:
Upgrade local claude-ops <CUR> → <NEW>? (prunes N old cache versions, rewrites M files)
[Apply upgrade]
[Force re-materialise cache] ← only if same-version stale-cache is suspected
[Cancel]${CLAUDE_PLUGIN_ROOT}/bin/ops-update # or: --forceStream the step-by-step output. On success, surface the final line verbatim:
Restart Claude Code (or run `/reload-plugins`) to load v<NEW>.
The running session will NOT see the new version until reload — this is a Claude Code constraint, not a failure.
| Flag | Effect |
|---|---|
--dry-run | Report only; change nothing. Always run this first. |
--force | Force-reinstall even when the CLI claims "already latest" (bug #61954). |
--to X.Y.Z | Target a specific version instead of the catalogue's newest. |
--no-prune | Keep old cache versions. |
--no-patches | Skip the cache-patch reapply step. |
--no-rewrite | Skip the stale-version-path rewrite step. |
--no-localsync | Skip fast-forwarding a linked local source checkout's main. |
The bin auto-detects a non-TTY and drops colour; its output is already line-per-fact, so relay it as-is — no tables, no banners.
"already on <ver>" → nothing to prune/rewrite/migrate).
$HOME/.claude/pluginsstate; it writes no personal data.
${CLAUDE_PLUGIN_ROOT}/bin/ops-release(bumps plugin.json + marketplace.json + CHANGELOG, opens the release PR, tags). ops-release ships it; ops-update pulls it down locally.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.