auto-updater

To safely update installed skills, you need a human-reviewed update plan that fetches exact commit SHAs, produces unified diffs, and blocks application unless explicitly approved. This prevents unwanted automatic changes.

SHA pinning for skill updates checks for newer commits at the exact immutable SHA level rather than mutable tags. This ensures you review the precise code changes before applying them to your environment.

A diff-first trust review presents a full code diff and explicitly flags security-sensitive areas like hooks, MCP configuration, and tool permissions before any update is applied.

Running a QA gate before applying skill updates involves executing a read-only QA rescan on the new version. The update is automatically blocked if regressions or explicit REFUSE-tier findings are detected.

Yes, auto-updater applies to update workflows triggered by user commands or the registry-sync agent for pinned installs, requiring explicit human approval after a security-flagged diff review.