Agent skill · lobehub
desktop-security-update
Inspect, mark, or revoke vulnerable LobeHub Desktop versions through the existing release workflow and signed R2 security policy. Use for forced security updates across Stable, Canary, Beta, and Nightly.
What it needs
About 3k tokens when loaded.
What this skill does
Desktop security updates Operate .github/workflows/release-desktop-core-ota.yml using its securitypolicy input. This selects only the policy job; it does not build or publish Core. The policy is global across channels at <UPDATESERVERURL base>/security-policy.json in the existing update bucket. Read the policy contract for client behavior and delivery limitations. The deterministic operator is apps/desktop/scripts/desktopSecurityPolicy.mjs; it shares schema/signature validation with the client. Do not hand-sign JSON, fetch signing secrets locally, replace the whole rule set, or add a workflow. Resolve the request For a mark, determine the installer build channel, platforms, shell or core target, affected npm SemVer range, fixed full-installer version, and reason. An exact version is a valid range. Do not guess the affected scope from the latest release. If scope is ambiguous, inspect the current policy while asking only for the missing scope. Publish the fixed installer first: the operator checks the public feed and installer availability for every requested platform, including both macOS architectures. Beta uses the Canary installer feed. A concrete user instruction to mark or revoke a specified scope authorizes that operation. If the user only asks to investigate or prepare, stop after inspection/preview. Do not invent a security restriction while implementing or testing this tooling. Never automatically weaken a range or minimum to make a failed preflight pass. Inspect, preview, apply 1. Resolve the actual repository with gh repo view --json nameWithOwner. Use the trusted canary branch after this workflow change is merged. Check that the remote workflow at the selected ref contains securitypolicy before dispatching; an older workflow could otherwise run an ordinary Core release. Do not dispatch unreviewed code with production signing secrets. 2. Dispatch {"action":"inspect"}. …
How to use it
Reference it in AdaL, Claude Code, Cursor or any coding agent — nothing to install:
@skills lobehub/desktop-security-update