Agent skill · operations · steipete
fleet-maintenance
Mac fleet inventory and upkeep with full/worker profiles: collect installed apps and packages, compare desired versus observed state, audit local-account escrow references, update Homebrew/global packages, safely sync repos and Xcode, and report disk, service, backup, update, and security health.
Why this skill is useful
Adds multiple executable scripts for auditing and maintaining Mac fleet configurations that aren't in public documentation.
What it needs
Requires 1password, homebrew installed locally. Requires 1password account access. About 10k tokens when loaded. Last updated 2026-08-06. 6,510 stars on the source repository.
What this skill does
Fleet Maintenance Maintain Peter's Macs while protecting ambiguous local work. Package updates are explicitly allowed during active sessions and may disrupt the software being upgraded. Use $remote-mac for inventory/SSH and $xcode-sync for all Xcode work. Desired state Read ~/Projects/manager/fleet/inventory.json for desired software and local-account escrow references. Read references/fleet-schema.md before changing its schema or adopting packages. Keep exactly two profiles unless Peter explicitly changes the model: full: daily-driver Macs with the complete development, communication, media, and agentic toolset. worker: lean remote Macs that mainly run Codex, Claude, OpenClaw nodes, and supporting agent infrastructure. Treat profile policy as minimum: install required entries and report extras without removing them. Never silently turn observed software into desired state. Keep topology, SSH routing, and handed-off status in ~/Projects/manager/computers.yaml. Do not duplicate live topology in this skill. Keep passwords, recovery keys, and private keys in 1Password. The inventory stores opaque item IDs only. Invoke $one-password before any op command; a pending reference is not an error during package maintenance. Require the classic OpenSSH mesh named by sshmesh on both profiles. The manager fleet setup document owns the canonical peer list and live proof. Use the symmetric Tailscale TCP 22 grant plus per-host authorizedkeys; macOS GUI Tailscale clients cannot act as Tailscale SSH servers. Distribute public keys only, keep private keys host-local, verify both directions with BatchMode=yes and a finite timeout, and leave offline or provider-blocked directions pending. Require the stable 1Password CLI integrity baseline on every fleet Mac. Require the file-backed service-account profile block unless that host has a documented requirementexceptions security boundary in inventory. …
How to use it
Reference it in AdaL, Claude Code, Cursor or any coding agent — nothing to install:
@skills steipete/fleet-maintenance