SecurityUpdates

• A run returns at most 32 items, deduplicated across sources, ranked within News, Research and Ideas, each attributed to its source, and none fabricated.
• Nothing surfaced on an earlier run surfaces again, dated or not: every shown item's key is recorded in MEMORY/STATE/SecurityUpdates-last-check.json after each successful run, and the next run's candidates are filtered against it by Tools/Digest.ts (Intents/Update.md § Tool contract).
• Items come only from the configured sources: the six defaults in sources.json, swapped or extended through PREFERENCES.md.

Default: Run the Update intent.

User customizations, read before each run: <configRoot>/LIFEOS/USER/CUSTOMIZATIONS/SKILLS/SecurityUpdates/PREFERENCES.md configRoot is $CLAUDE_CONFIG_DIR when set, else ~/.claude.

If the file exists, apply it: it can add sources and say which topics to emphasise or drop, and it overrides default behavior (the 32-item cap and the three categories stay). If it does not exist, proceed with the six default sources; nothing here is required. Setup, a smallest working PREFERENCES.md and the proof command are in Setup.md. Run state is not config: it is written to MEMORY/STATE/SecurityUpdates-last-check.json (shape in Intents/Update.md § Tool contract).

sources.json in the skill root is the one list of the six default sources: id, name, URL, type, and the categories each one feeds.

Custom sources: list them under "Extra sources" in PREFERENCES.md (see Data & Config); sources.json in the skill root holds the six defaults and is overwritten by updates, so do not edit it.

• Not for stack-specific CVE tracking: use your own vulnerability-management tooling for that (a private overlay skill routes those requests on its own triggers). SecurityUpdates is for industry-wide security news.
• Research publications vs news: Distinguish between new research papers and news reporting. Cite appropriately.

"What's new in security?" → Update intent → a ranked ≤32-item digest of what is new across all six sources since ~/.claude/LIFEOS/MEMORY/STATE/SecurityUpdates-last-check.json was last written, and that state file updated for the next run.

"/secupdates" → same Update intent, slash-command entry.

Second run same day → only items whose keys are not already in the state file surface; an empty digest with "no new items since last check" is the correct result, not a failure.