auto-updater

Safely updating community legal skills requires verifying pinned commit SHAs against newer versions and displaying full diffs before any changes. This process enforces explicit human approval to prevent compromised or behavior-altering code from being applied without review.

Commit pinning protects skill updates by comparing an installed skill's immutable commit SHA to the latest upstream version. This flags any divergence, ensuring updates are deliberate and preventing silent introductions of unexpected changes to your privileged legal environment.

Running a security review for MCP and hooks config updates involves displaying full diffs for security-relevant files like hooks.json and .mcp.json before anything changes. It requires immutable-commit resolution and fails closed if high-risk security-surface changes are detected.

Yes, the skill update process requires explicit human approval per update after producing and reviewing a diff. It also supports a notification-only mode, ensuring you remain in control of all applied changes in privileged legal environments.

If a security scan regression is detected during a skill update, the system fails closed and halts the update. It re-runs skills-qa against the new version to catch regressions and block high-risk patterns before any changes are applied.