Skip to content
Back to skills

Upload Dmg

BSecurity

Upload the latest desktop DMG and update artifacts to install.vibesos.com. Use when the user says "upload the DMG", "update install link", "push new DMG", or "release desktop app".

  • 133 stars
  • 0 votes
  • 0 copies
  • 1 view
  • Added May 26, 2026
developmentbash

Security analysis

B75/100
  • criticalExfiltrates credentials via HTTP — exact pattern from Snyk ToxicSkills study
  • criticalSends environment variables or credentials to an external URL

Pro shows the line behind each finding and how to fix it

Scanned May 27, 2026

npx -y skills add popmechanic/VibesOS --skill upload-dmg --agent claude-code

Installs into .claude/skills of the current project.

Are you the author of Upload Dmg?

Add the live security badge to your README. It updates with every re-scan.

Security grade badge for Upload Dmg
[![Security: B — Skills Directory](https://www.skillsdirectory.com/api/skills/popmechanic-upload-dmg/badge)](https://www.skillsdirectory.com/skills/popmechanic-upload-dmg)

More formats (shields.io, HTML) on the badges page. Keep it an A: scan every change in CI with Pro.

Download with Pro
SKILL.md
---
name: upload-dmg
description: Upload the latest desktop DMG and update artifacts to install.vibesos.com. Use when the user says "upload the DMG", "update install link", "push new DMG", or "release desktop app".
license: MIT
allowed-tools: Bash, Read
metadata:
  author: "Marcus Estes"
---

## Upload DMG and Update Artifacts to install.vibesos.com

Upload the latest built DMG and auto-updater artifacts to the install worker's R2 bucket.

### Steps

1. Read the version from plugin.json:

```bash
VIBES_ROOT="${CLAUDE_PLUGIN_ROOT:-$(dirname "$(dirname "${CLAUDE_SKILL_DIR}")")}"
VERSION=$(jq -r .version "$VIBES_ROOT/.claude-plugin/plugin.json")
echo "Version: $VERSION"
```

2. Verify the DMG and update artifacts exist:

```bash
VIBES_ROOT="${CLAUDE_PLUGIN_ROOT:-$(dirname "$(dirname "${CLAUDE_SKILL_DIR}")")}"
ARTIFACTS="$VIBES_ROOT/vibes-desktop/artifacts"
DMG_PATH="$ARTIFACTS/stable-macos-arm64-VibesOS.dmg"
if [ ! -f "$DMG_PATH" ]; then
  echo "ERROR: DMG not found at $DMG_PATH — run 'bash scripts/build-desktop.sh' first"
  exit 1
fi
ls -lh "$DMG_PATH"

# Check for update artifacts (optional — first build with baseUrl won't have them)
UPDATE_JSON="$ARTIFACTS/stable-macos-arm64-update.json"
UPDATE_TAR="$ARTIFACTS/stable-macos-arm64-VibesOS.app.tar.zst"
[ -f "$UPDATE_JSON" ] && echo "Found: $(basename $UPDATE_JSON)" || echo "No update.json (first build?)"
[ -f "$UPDATE_TAR" ] && echo "Found: $(basename $UPDATE_TAR) ($(ls -lh "$UPDATE_TAR" | awk '{print $5}'))" || echo "No .tar.zst (first build?)"
PATCH_COUNT=$(ls "$ARTIFACTS"/*.patch 2>/dev/null | wc -l | tr -d ' ')
echo "Patch files: $PATCH_COUNT"
```

3. Upload the DMG:

```bash
VIBES_ROOT="${CLAUDE_PLUGIN_ROOT:-$(dirname "$(dirname "${CLAUDE_SKILL_DIR}")")}"
VERSION=$(jq -r .version "$VIBES_ROOT/.claude-plugin/plugin.json")
DMG_PATH="$VIBES_ROOT/vibes-desktop/artifacts/stable-macos-arm64-VibesOS.dmg"
UPLOAD_KEY=$(grep INSTALL_UPLOAD_KEY "$VIBES_ROOT/.env" | cut -d= -f2)

curl -X PUT "https://install.vibesos.com/upload?filename=VibesOS-${VERSION}.dmg" \
  -H "X-Upload-Key: ${UPLOAD_KEY}" \
  --data-binary "@${DMG_PATH}" \
  --progress-bar -w "\nHTTP %{http_code}\n"
```

4. Upload update artifacts (update.json and .tar.zst):

```bash
VIBES_ROOT="${CLAUDE_PLUGIN_ROOT:-$(dirname "$(dirname "${CLAUDE_SKILL_DIR}")")}"
ARTIFACTS="$VIBES_ROOT/vibes-desktop/artifacts"
UPLOAD_KEY=$(grep INSTALL_UPLOAD_KEY "$VIBES_ROOT/.env" | cut -d= -f2)

UPDATE_JSON="$ARTIFACTS/stable-macos-arm64-update.json"
UPDATE_TAR="$ARTIFACTS/stable-macos-arm64-VibesOS.app.tar.zst"

if [ -f "$UPDATE_JSON" ]; then
  echo "Uploading update.json..."
  curl -X PUT "https://install.vibesos.com/upload?filename=updates/stable-macos-arm64-update.json" \
    -H "X-Upload-Key: ${UPLOAD_KEY}" \
    --data-binary "@${UPDATE_JSON}" \
    -s -w "HTTP %{http_code}\n"
else
  echo "Skipping update.json (not found)"
fi

if [ -f "$UPDATE_TAR" ]; then
  echo "Uploading .tar.zst..."
  curl -X PUT "https://install.vibesos.com/upload?filename=updates/stable-macos-arm64-VibesOS.app.tar.zst" \
    -H "X-Upload-Key: ${UPLOAD_KEY}" \
    --data-binary "@${UPDATE_TAR}" \
    --progress-bar -w "\nHTTP %{http_code}\n"
else
  echo "Skipping .tar.zst (not found)"
fi
```

5. Upload patch files (if any):

```bash
VIBES_ROOT="${CLAUDE_PLUGIN_ROOT:-$(dirname "$(dirname "${CLAUDE_SKILL_DIR}")")}"
ARTIFACTS="$VIBES_ROOT/vibes-desktop/artifacts"
UPLOAD_KEY=$(grep INSTALL_UPLOAD_KEY "$VIBES_ROOT/.env" | cut -d= -f2)

PATCHES=$(ls "$ARTIFACTS"/*.patch 2>/dev/null)
if [ -n "$PATCHES" ]; then
  for PATCH in $PATCHES; do
    BASENAME=$(basename "$PATCH")
    echo "Uploading patch: $BASENAME..."
    curl -X PUT "https://install.vibesos.com/upload?filename=updates/${BASENAME}" \
      -H "X-Upload-Key: ${UPLOAD_KEY}" \
      --data-binary "@${PATCH}" \
      -s -w "HTTP %{http_code}\n"
  done
else
  echo "No patch files to upload"
fi
```

6. Confirm the upload by reporting the version and download URL:

```
Uploaded VibesOS-{VERSION}.dmg + update artifacts
Download: https://install.vibesos.com
Update check: https://install.vibesos.com/updates/stable-macos-arm64-update.json
```

Attribution

Is this your skill, or is something wrong with this listing? Request removal or report an issue. Author removals are honored within 72 hours.

Comments

Loading comments…

Newsletter

Get the weekly list of safe new skills, and the ones we pulled.