How do I install the Electron Auto Update skill?

Run npx skillmds@latest add sheshiyer/electron-auto-update in your terminal (requires Node.js), paste this page's agent-chat prompt into Claude, Cursor, or any MCP-connected agent, or download the SKILL.md file and copy it into your agent's skills directory.

Is Electron Auto Update safe to use?

This skill has not completed SkillMD's automated safety review yet. SkillMD never runs a skill's scripts for you; review the SKILL.md before installing.

Which AI agents work with Electron Auto Update?

This skill is tagged as working with Claude Code, Claude.ai, OpenAI Codex. SKILL.md is an open format, so most agents that read a skills directory can load it too.

Is Electron Auto Update free to use?

Yes. Installing skills from SkillMD is free, and the skill stays under its author's original license.

Who published Electron Auto Update?

Sheshiyer (@sheshiyer) published this skill. Their other Agent Skills are listed on their SkillMD profile.

Electron Auto Update by sheshiyer — Agent Skill

Name: Electron Auto Update
Author: Sheshiyer

Electron Auto Update

Ship updates to installed Electron apps — autoUpdater / electron-updater, update feeds (S3/GitHub/generic), signed differential updates, and staged rollouts with rollback. USE WHEN adding or debugging auto-update, choosing an update server, or handling update events safely. Updates must be signed.

Sheshiyer 2a38765 2.1 KB Updated Sep 17, 2026

File contents

Electron Auto-Update

Delivering new versions after install. Two layers: Electron's built-in autoUpdater (uses Squirrel on macOS/Windows) and electron-updater (from electron-builder — feeds, deltas, more control). Most electron-builder apps use electron-updater.

The flow

CI publishes signed artifacts + a manifest (latest.yml/latest-mac.yml) to a feed (GitHub Releases, S3, or a generic HTTPS server).
The app checks the feed (autoUpdater.checkForUpdates() / electron-updater), downloads in the background, and installs on quit (or on user confirm).
Signature is verified before applying — updates inherit the same signing as the installer (electron-builder-packaging); an unsigned/forged update must be rejected.

Handle the events (don't silently swap binaries)

autoUpdater.on('update-available', /* notify */);
autoUpdater.on('download-progress', /* show progress */);
autoUpdater.on('update-downloaded', () => promptThenQuitAndInstall());
autoUpdater.on('error', /* log + surface, don't crash */);

Rules

Updates must be signed/verified — the update channel is a code-execution channel; treat it like one.
Serve the feed over HTTPS; pin the host; never an unauthenticated HTTP feed.
Stage rollouts (a percentage) and keep the previous version available for rollback.
macOS auto-update requires signing + notarization; Windows requires a signed installer + matching feed.
Let the user defer; install on quit by default — don't yank the app out from under work.

Guardrails

Signed, HTTPS-only, verified-before-apply updates — no exceptions.
Staged rollout + rollback path; surface errors instead of failing silently.
Reuse the packaging signing identity (electron-builder-packaging).

---name: electron-auto-updatedescription: Ship updates to installed Electron apps — autoUpdater / electron-updater, update feeds (S3/GitHub/generic), signed differential updates, and staged rollouts with rollback. USE WHEN adding or debugging auto-update, choosing an update server, or handling update events safely. Updates must be signed.---# Electron Auto-UpdateDelivering new versions after install. Two layers: Electron's built-in **`autoUpdater`** (usesSquirrel on macOS/Windows) and **`electron-updater`** (from electron-builder — feeds, deltas,more control). Most electron-builder apps use `electron-updater`.## The flow1. CI publishes signed artifacts + a manifest (`latest.yml`/`latest-mac.yml`) to a **feed** (GitHub Releases, S3, or a generic HTTPS server).2. The app checks the feed (`autoUpdater.checkForUpdates()` / `electron-updater`), downloads in the background, and installs on quit (or on user confirm).3. Signature is **verified** before applying — updates inherit the same signing as the installer (`electron-builder-packaging`); an unsigned/forged update must be rejected.## Handle the events (don't silently swap binaries)```jsautoUpdater.on('update-available', /* notify */);autoUpdater.on('download-progress', /* show progress */);autoUpdater.on('update-downloaded', () => promptThenQuitAndInstall());autoUpdater.on('error', /* log + surface, don't crash */);```## Rules- **Updates must be signed/verified** — the update channel is a code-execution channel; treat it like one.- Serve the feed over **HTTPS**; pin the host; never an unauthenticated HTTP feed.- **Stage rollouts** (a percentage) and keep the previous version available for **rollback**.- macOS auto-update **requires** signing + notarization; Windows requires a signed installer + matching feed.- Let the user defer; install on quit by default — don't yank the app out from under work.## Guardrails- Signed, HTTPS-only, verified-before-apply updates — no exceptions.- Staged rollout + rollback path; surface errors instead of failing silently.- Reuse the packaging signing identity (`electron-builder-packaging`).

Frequently asked questions