360 Secure SkillHub
360 安全技能中心

Os Update Checker

这是一款只读跨平台包更新检查工具，自动适配主流包管理器（如apt、dnf、brew等），核心功能为列出可升级包、获取变更日志并将更新分为安全、中、低三级风险。适合系统更新状态核查、升级前决策审核及定时健康监控场景，支持命令行调用，输出可读文本或JSON格式，可跳过变更日志快速统计，全程不修改系统。

pfrederiksen
pfrederiksen
热度 74.33
最近更新 2026-05-11 17:29:14
分类：自动化依赖：代码执行应用场景：DevOps / 自动化脚本

安装技能

复制下面的话术发给你的 Agent，它会通过 secure-skills 检索并安装该技能。

执行命令安装此 skill： npx secure-skills-cli add os-update-checker
Metadata
name
os-update-checker
version
1.2.0
description
Check for available OS package updates with per-package changelog summaries and risk classification. Supports apt (Debian/Ubuntu), dnf (Fedora/RHEL), yum (CentOS 7), pacman (Arch), zypper (openSUSE), apk (Alpine), brew (macOS), and npm (global packages). Use when: checking system update status, before approving upgrades, or in heartbeats/cron for periodic OS health monitoring. Read-only — does not install or modify anything.

OS Update Checker

Read-only, cross-platform package update checker. Auto-detects the available package manager, lists upgradable packages, fetches changelogs, and classifies risk (security, moderate, low). Designed to give enough context to approve or defer an upgrade confidently.

Supported Package Managers

OS / Runtime Package Manager
Debian / Ubuntu / Mint apt
Fedora / RHEL 8+ / Rocky / Alma dnf
CentOS 7 / RHEL 7 yum
Arch / Manjaro / EndeavourOS pacman / checkupdates
openSUSE Leap / Tumbleweed / SLES zypper
Alpine Linux apk
macOS / Linux (Homebrew) brew
Node.js (global npm packages) npm

Usage

# Human-readable summary with changelogs (auto-detects OS)
python3 scripts/check_updates.py

# JSON output (for dashboards, cron, integrations)
python3 scripts/check_updates.py --format json

# Skip changelogs for a quick count
python3 scripts/check_updates.py --no-changelog

Risk Classification

  • 🔴 security — source repo contains a security indicator
  • 🟡 moderate — critical package (kernel, openssh, openssl, sudo, curl, bash, etc.)
  • 🟢 low — standard maintenance update

How It Works

  1. Detects available package manager from PATH (apt → dnf → yum → pacman → zypper → apk → brew)
  2. Lists upgradable packages using the appropriate read-only command
  3. Validates each package name against a per-backend allowlist regex before any further use
  4. Fetches the most recent changelog entry per package (apt: apt changelog; dnf/yum: rpm --changelog; others: package info)
  5. Reports in text or JSON format

Security Design

  • subprocess is used exclusively with shell=False — arguments are passed as a list, never interpolated into a shell string
  • Package names are validated against per-backend allowlist patterns before use in commands
  • All exceptions are caught by specific type — no bare except
  • Read-only commands only — no installs, no writes, no service restarts

System Access

  • Commands (read-only): apt list, apt changelog, dnf check-update, rpm -q --changelog, yum check-update, pacman -Qu, pacman -Si, zypper list-updates, zypper info, apk list, apk info, brew outdated, brew info, npm outdated -g --json
  • Network: Outbound HTTPS to distribution changelog servers (apt); outbound HTTPS to registry.npmjs.org (npm); others use local package metadata
  • No file writes

Requirements

  • Python 3.10+
  • One supported package manager available on PATH