Skip to content
Get packs

Guide · Agent skill

How to use the SecurityUpdates agent skill: install and run it

Updated · written with AI from the project's own documentation and checked against our catalogue data

SecurityUpdates is an agent skill, a packaged set of instructions and a script that a Claude-based agent can load and use. Once installed, asking for security updates makes the agent collect stories from six public security sites and return one digest. This guide explains what the skill does, how to install it, how to trigger it, and what it needs and touches on your machine, so you can run your first digest and understand the results.

Security News Digestdanielmiessler/LifeOS · MIT

Quick start

  1. 1Download the ZIP. Get the SecurityUpdates ZIP from this directory page.
  2. 2Unzip into a skills folder. Unzip it into ~/.claude/skills/ for personal use, or into a project's .claude/skills/ folder for one project. Alternatively, upload the ZIP in the Claude apps under Settings, then Capabilities, then Skills.
  3. 3Install Bun. The skill's script needs the Bun runtime, so make sure Bun is available before the first run.
  4. 4Check the install. Run the status command from the skill's Setup page and confirm it reports six sources.
  5. 5Ask for security updates. Say something like What's new in security, or type /secupdates, and the agent returns a digest of up to 32 items.
  6. 6Run again to see only new items. A second run compares against the state file, so already-shown items are left out. An empty result with no new items is expected.

What the SecurityUpdates skill makes the agent do

When you ask for security updates, the agent fetches six sources: tl;dr sec, No Security, Krebs on Security, The Hacker News, Schneier on Security and Risky Business. It ranks the items and merges duplicates, so a story reported by several sites appears once. The result is a digest of up to 32 items, grouped into Security News, Security Research and Security Ideas.

Each item is attributed to the site it came from. A local state file records what earlier runs showed, so the next run lists only new items. If nothing new has appeared, the correct result is an empty digest with a note saying there are no new items since the last check.

  • Security News: breaches and leaks, ransomware, state-sponsored and other active attacks, major vulnerability exploitation, and company security incidents.
  • Security Research: new CVEs and vulnerability disclosures, papers, attack techniques, tool releases and bug bounty findings.
  • Security Ideas: opinion and strategy pieces.

Install the SecurityUpdates skill

Download the SecurityUpdates ZIP from this directory page. Then either unzip it into your personal skills folder, ~/.claude/skills/, or into a project's .claude/skills/ folder if you want the skill available only in that project. Alternatively, if you use the Claude apps, upload the ZIP under Settings, then Capabilities, then Skills.

To confirm the skill is in place, run the status check from the skill's Setup page. It counts the sources in sources.json and should report six sources. The check reads the file from ~/.claude/skills/SecurityUpdates/, so it applies to the personal install location.

bun -e 'const s=JSON.parse(require("fs").readFileSync(process.env.HOME+"/.claude/skills/SecurityUpdates/sources.json","utf8")); console.log(s.sources.length+" sources")'

How to trigger the skill with natural requests

You do not need special syntax. The skill is triggered by phrases such as security updates, sec updates, what's new in security, weekly security digest, breaches, CISO strategy, or by names of its sources such as tldrsec, Krebs or Schneier. The slash command /secupdates also runs the same update.

If you ask for the Update intent by any of these, the agent runs the update and then records what it showed. Requests about stack-specific CVEs or AI industry news do not match this skill; see the limits section below.

  • What's new in security?
  • Give me the security updates for this week.
  • /secupdates
  • Any breaches reported today? Show me the sec updates.

What the skill needs and what it touches

The skill needs the Bun runtime, because it runs its script Tools/Digest.ts. It needs internet access to fetch the six default sources. It also expects a Claude Code or compatible agent environment that uses the LifeOS directory structure, since its paths and shared tools depend on it. It needs no accounts and no API keys.

The skill runs a script and uses the network. It writes one state file, MEMORY/STATE/SecurityUpdates-last-check.json, which records the items already shown. It is not meant to be edited by hand. Its default source list is in sources.json, which updates overwrite, so do not edit it. To add sources or steer topics, create the optional PREFERENCES.md file described below.

  • Optional config file: <configRoot>/LIFEOS/USER/CUSTOMIZATIONS/SKILLS/SecurityUpdates/PREFERENCES.md. configRoot is $CLAUDE_CONFIG_DIR when set, otherwise ~/.claude.
  • Smallest working PREFERENCES.md lists extra sources under an 'Extra sources:' heading as a bullet list.
  • Nothing is required. Without the file, the six default sources are used.

Tips and safety notes

Check the links before acting on anything. The ranking and merging involve editorial judgment, and the digest may miss breaking stories if a source is slow or unavailable. Treat it as a briefing, not as a verified record.

For CVEs in your own technology stack, use your own vulnerability-management tooling. The skill covers industry-wide news only. AI industry news is handled by a separate skill, Upgrade NewsDigest.

  • Run it weekly for a repeatable briefing; a second run on the same day should show only items not already seen.
  • Distinguish research papers from news reporting when you cite them.
  • Keep the state file in place if you want the no-repeats behaviour to continue between runs.

What people use it for

  • A CISO reading one weekly industry briefing instead of checking six sites.
  • A developer who wants a short overview of recent breaches and research without triaging CVEs for their own stack.
  • A security team keeping a repeatable digest where stories are not repeated between runs.
  • Adding a team's own blog or feed as an extra source through the PREFERENCES.md file.

Frequently asked questions

How do I install the SecurityUpdates agent skill?

Download the ZIP from the directory page and unzip it into ~/.claude/skills/ for personal use, or into a project's .claude/skills/ folder. In the Claude apps, you can instead upload the ZIP under Settings, then Capabilities, then Skills.

Is the SecurityUpdates skill free?

The skill is listed under the MIT licence. The source does not mention pricing, and it needs no accounts or API keys, so the only requirements are the Bun runtime and internet access.

What do I need to run the SecurityUpdates skill?

You need the Bun runtime to run Tools/Digest.ts, internet access to fetch the six default sources, and a Claude Code or compatible agent environment that uses the LifeOS directory structure.

Why does the digest show nothing new when I run it twice?

The skill saves the items it showed in a state file and filters later runs against it. If there are no new items since the last check, an empty digest is the correct result, not an error.

Can I add my own news sources to SecurityUpdates?

Yes. List them under Extra sources in PREFERENCES.md in your customisations folder. Do not edit sources.json, because updates overwrite it.

Does SecurityUpdates replace a vulnerability scanner for my stack?

No. It covers industry-wide security news only and is not for prioritising CVEs against your own technology stack. Use your own vulnerability-management tooling for that, and use the Upgrade NewsDigest skill for AI industry news.

New agent skills, repos and AI tools — every week

The best new skills and open-source projects, the fastest-growing repos, and one free prompt. Five minutes to read. Unsubscribe anytime.

Our verdict

SecurityUpdates suits security professionals, CISOs and developers who want a repeatable, deduplicated weekly briefing from six well-known sources without reading each site. It is a poor fit if you need CVE prioritisation for your own stack or AI industry news, and you should always check its items against the original links, since it can miss breaking stories.

Download the skill