What problem does it solve? Community skills installed in a legal environment can change upstream, and blindly updating code that runs with privileged access is a security risk. This Skill detects available updates, shows exactly what changed, and blocks any update from being applied without explicit human approval. ## Core Features & Use Cases - SHA-pinned update checks: Compares each installed skill's pinned commit SHA against the source registry, ignoring mutable tags and branches. - Trust review and diff display: Shows full unified diffs and flags changes to hooks, MCP server configs, tool permissions, network calls, and the skill's stated purpose. - Security re-scan and freshness checks: Re-runs a skills-qa scan on the new version in a read-only subagent and verifies whether bundled reference material is still within its freshness window. - Backup and rollback: Backs up the old version before applying an update and supports restoring it with a rollback command. - Use Case: A legal team runs the updater weekly to see whether any installed skills have new commits, reviews the diffs for permission changes, and approves only the updates that pass the security re-scan. ## Quick Start Ask the assistant to check for updates to your installed skills and show the diffs before applying anything.
