auto-updater

To safely check legal skills for updates, compare installed commit SHAs against source registry commits to identify version differences. This ensures immutable pinning and detects whether newer versions exist before any modifications are applied.

A legal skill update security review generates diffs and performs targeted trust checks on high-risk surfaces like hook execution, MCP credential access, tool permission changes, and network or filesystem side effects to prevent unsafe modifications.

No, applying legal workflow skill updates requires explicit human approval. The system uses fail-closed security gates and requires you to review the generated diff before any changes are committed to your environment.

Commit pinning prevents unexpected changes by locking installed legal skills to specific commit SHAs. The updater compares these pinned hashes against the source registry to ensure only reviewed and approved modifications are applied.

Fail-closed security gates block legal skill updates by running a skills-qa style rescan against the new version. If regressions or refuse-tier findings appear in hooks, MCP configuration, or permissions, the update is blocked.

Use a human approval workflow for skills updates in privileged legal environments where trust verification is required. It is necessary when updates affect hooks, MCP servers, or tool permissions to ensure compliance and security.