Skip to content
Back to skills

Update

ASecurity

Keep Clay up to date. Use when the user asks to update or upgrade Clay, the plugin, or the `clay` CLI; when `clay update` reports the CLI is pinned / managed by the plugin; or to check whether a newer version is available. The plugin and CLI update independently; migrate older plugin-managed installs through setup.

  • 129 stars
  • 0 votes
  • 0 copies
  • 0 views
  • Added September 3, 2026
ai-agentsbash

Works with

  • claude code
  • cursor
  • cli

Security analysis

A92/100
  • mediumInstalls packages at runtime which could introduce malicious dependencies

Pro shows the line behind each finding and how to fix it

Scanned September 24, 2026

npx -y skills add clay-run/agent-plugins --skill update --agent claude-code

Installs into .claude/skills of the current project.

Are you the author of Update?

Add the live security badge to your README. It updates with every re-scan.

Security grade badge for Update
[![Security: A — Skills Directory](https://www.skillsdirectory.com/api/skills/clay-run-update/badge)](https://www.skillsdirectory.com/skills/clay-run-update)

More formats (shields.io, HTML) on the badges page. Keep it an A: scan every change in CI with Pro.

Download with Pro
SKILL.md
---
name: update
description: Keep Clay up to date. Use when the user asks to update or upgrade Clay, the plugin, or the `clay` CLI; when `clay update` reports the CLI is pinned / managed by the plugin; or to check whether a newer version is available. The plugin and CLI update independently; migrate older plugin-managed installs through setup.
allowed-tools: Bash, Read
---

# Keeping Clay up to date

The CLI is installed independently. The plugin declares its minimum compatible CLI
in `cli-min-version`; a newer CLI is fine. Updating one does not automatically update
the other.

## 1. Check and update the CLI

Run `bash "<PLUGIN_ROOT>/scripts/check-cli.sh" plain`, resolving `<PLUGIN_ROOT>` two
levels above this skill. If it reports a missing, old, or plugin-managed executable,
follow the `setup` skill to locate the executable and choose the appropriate action:
existing native CLIs upgrade through their own `clay update`, npm CLIs through npm,
and missing or plugin-managed CLIs use installation or migration. An old plugin forwarder needs
migration even when a cached launcher still responds. Preserve the installation method
and existing sign-in.

Once the independent executable works, run `clay update --check` to check the latest
published release. Show the user what's new from the release URL when one is returned.
For a native installation, run `clay update`. For an npm installation, use
`npm install --global --ignore-scripts @clay-run/cli@latest`; `clay update` identifies
npm installs and provides that direction. Use the verified absolute executable path
if the current session's PATH has not refreshed.

## 2. Update the plugin

The marketplace is named `clay-plugins` and the plugin is `clay`. Pick your harness:

### Claude Code

Refresh the marketplace, then update the plugin:

```bash
claude plugin marketplace update clay-plugins
claude plugin update clay@clay-plugins
```

Then have the user run `/reload-plugins` (or restart Claude Code) so the new version
loads. If the plugin still shows the old version after that, the marketplace
clone was stale — the explicit `claude plugin marketplace update clay-plugins` above
force-refreshes it; as a last resort, uninstall and reinstall the `clay` plugin.

### Codex

Refresh the marketplace snapshot, then restart the Codex session:

```bash
codex plugin marketplace upgrade clay-plugins
```

`codex plugin marketplace upgrade` pulls the latest plugin version; restart Codex so
the running session picks it up.

### Cursor

Cursor is UI-driven — tell the user to do this (there's no reliable CLI path):

- Open **Customize** in the sidebar, find the **Clay** plugin, and click **Refresh**.
- With Auto Refresh enabled, Cursor picks up new commits atomically on its next refresh
  cycle; a manual **Refresh** forces it.
- If the content still looks stale, uninstall and reinstall the Clay plugin.

## 3. Verify both installations

After refreshing the plugin, read its new `cli-min-version` and run its
`scripts/check-cli.sh` again. If the minimum increased, run the current plugin's
`setup` skill. Confirm `clay --version` is at least that minimum. Only investigate
sign-in if an authenticated command reports an auth error; an update does not require
another login.

The session-start hook makes the same local readiness check. It does not poll releases
or install software. Hosts without hooks use the `clay` skill's readiness check instead.

Attribution

Is this your skill, or is something wrong with this listing? Request removal or report an issue. Author removals are honored within 72 hours.

Comments

Loading comments…

Newsletter

Get the weekly list of safe new skills, and the ones we pulled.