How do I install the Update Definitions skill?

Run npx skillmds@latest add tomevault-io/update-definitions in your terminal (requires Node.js), paste this page's agent-chat prompt into Claude, Cursor, or any MCP-connected agent, or download the SKILL.md file and copy it into your agent's skills directory.

Is Update Definitions safe to use?

This skill has not completed SkillMD's automated safety review yet. SkillMD never runs a skill's scripts for you; review the SKILL.md before installing.

Which AI agents work with Update Definitions?

This skill is tagged as working with Claude Code, Claude.ai, OpenAI Codex. SKILL.md is an open format, so most agents that read a skills directory can load it too.

Is Update Definitions free to use?

Yes. Installing skills from SkillMD is free, and the skill stays under its author's original license.

Who published Update Definitions?

tomevault-io (@tomevault-io) published this skill. Their other Agent Skills are listed on their SkillMD profile.

Update Definitions by tomevault-io — Agent Skill

Name: Update Definitions
Author: tomevault-io

Update Definitions

Refresh signature databases and definition files for every installed scanner — freshclam (ClamAV), rkhunter --update, lynis update info, AIDE differential check (does NOT promote a new baseline), debsecan suite refresh. Reads installed flags from plugin config and skips tools that aren't present. Triggers on "update AV definitions", "refresh signatures", "update clamav". Use when this capability is needed.

tomevault-io 831f58d 2 files · 3.2 KB Updated Sep 17, 2026

File contents

Update Definitions

Refresh signatures / databases for every installed scanner. Skips tools the config marks as not installed.

Config

${CLAUDE_USER_DATA:-${XDG_DATA_HOME:-$HOME/.local/share}/claude-plugins}/linux-av-manager/config.json

Read installed.* flags. For each tool present, run its update path:

Tool	Command	Notes
ClamAV	`sudo systemctl stop clamav-freshclam && sudo freshclam && sudo systemctl start clamav-freshclam`	Stop the service first to avoid lock contention.
rkhunter	`sudo rkhunter --update`	Updates property/signature data. Do not automatically run `--propupd` here — that re-baselines and would mask real changes.
Lynis	`sudo lynis update info`	Reports whether a newer Lynis is available; `apt upgrade lynis` if so.
chkrootkit	apt/dnf/pacman upgrade for the package	No separate signature feed.
AIDE	`sudo aide --check` and report deltas	This is a check, not an update. Surface deltas; only promote with explicit user instruction.
debsecan	`sudo apt update && debsecan --suite $(lsb_release -sc) --format detail`	Refresh apt index then list outstanding CVEs.

Output

Print a one-line per-tool status line:

clamav    ✓ updated  (main.cvd 6.x → 7.x; daily.cvd refreshed)
rkhunter  ✓ updated
lynis     ✓ no update available
aide      ⚠ 14 file deltas — review before promoting (sudo aide --update)
debsecan  ✓ 3 CVEs reported — see <scans_dir>/debsecan/<timestamp>.txt

Save AIDE/debsecan output (the only ones with real per-run findings) into <scans_dir>/<tool>/<timestamp>.txt so a later scan or audit can reference them.

Notes

Never auto-promote AIDE's new baseline.
Never auto-run rkhunter --propupd.
Do batch the refreshes — they're independent — but stream output as each finishes so the user sees progress.

Source: danielrosehill/Claude-Linux-AV-Manager-Plugin — distributed by TomeVault.

---name: update-definitionsdescription: Refresh signature databases and definition files for every installed scanner — freshclam (ClamAV), rkhunter --update, lynis update info, AIDE differential check (does NOT promote a new baseline), debsecan suite refresh. Reads installed flags from plugin config and skips tools that aren't present. Triggers on "update AV definitions", "refresh signatures", "update clamav". Use when this capability is needed.---# Update DefinitionsRefresh signatures / databases for every installed scanner. Skips tools the config marks as not installed.## Config```${CLAUDE_USER_DATA:-${XDG_DATA_HOME:-$HOME/.local/share}/claude-plugins}/linux-av-manager/config.json```Read `installed.*` flags. For each tool present, run its update path:| Tool | Command | Notes ||---|---|---|| ClamAV | `sudo systemctl stop clamav-freshclam && sudo freshclam && sudo systemctl start clamav-freshclam` | Stop the service first to avoid lock contention. || rkhunter | `sudo rkhunter --update` | Updates property/signature data. **Do not** automatically run `--propupd` here — that re-baselines and would mask real changes. || Lynis | `sudo lynis update info` | Reports whether a newer Lynis is available; `apt upgrade lynis` if so. || chkrootkit | apt/dnf/pacman upgrade for the package | No separate signature feed. || AIDE | `sudo aide --check` and report deltas | This is a *check*, not an update. Surface deltas; only promote with explicit user instruction. || debsecan | `sudo apt update && debsecan --suite $(lsb_release -sc) --format detail` | Refresh apt index then list outstanding CVEs. |## OutputPrint a one-line per-tool status line:```clamav ✓ updated (main.cvd 6.x → 7.x; daily.cvd refreshed)rkhunter ✓ updatedlynis ✓ no update availableaide ⚠ 14 file deltas — review before promoting (sudo aide --update)debsecan ✓ 3 CVEs reported — see <scans_dir>/debsecan/<timestamp>.txt```Save AIDE/debsecan output (the only ones with real per-run findings) into `<scans_dir>/<tool>/<timestamp>.txt` so a later `scan` or audit can reference them.## Notes- Never auto-promote AIDE's new baseline.- Never auto-run `rkhunter --propupd`.- Do batch the refreshes — they're independent — but stream output as each finishes so the user sees progress.---> Source: [danielrosehill/Claude-Linux-AV-Manager-Plugin](https://github.com/danielrosehill/Claude-Linux-AV-Manager-Plugin) — distributed by [TomeVault](https://tomevault.io).

Frequently asked questions

Update Definitions

File contents

Update Definitions

Config

Output

Notes

Related skills

Frequently asked questions

How do I install the Update Definitions skill?

What does the Update Definitions skill do?

Is Update Definitions safe to use?

Which AI agents work with Update Definitions?

Is Update Definitions free to use?

Who published Update Definitions?