auto-updater

To safely check for community skill updates, compare the pinned commit SHA of your installed skills against their upstream source to surface differences with full diff context, requiring explicit human approval before applying any changes.

Commit SHA pinning tracks the exact code version installed locally. By comparing this SHA against the latest upstream commit, the registry sync detects whether new updates are truly available before fetching or applying them.

Security gating flags risky changes involving hooks, MCP configuration, tool or permission escalation, network access, and file-write or command-execution behavior, while also running a fresh version QA rescan before applying updates.

Yes, you can review a human-readable diff before applying skill updates. The process presents detailed diffs and explicitly flags high-risk surface areas like hooks, MCP config, and credential-relevant changes for your approval.

To rollback a broken skill update, use the controlled apply and rollback feature which supports restoring prior versions. This ensures you can revert to the previous pinned commit SHA if the new update causes issues.

A QA rescan is needed for freshness re-verification when a skill's reference material may be past its verification window. This surfaces outdated content even if the upstream commit SHA has not changed.