skill-update-check

To detect upstream drift in imported GitHub skills, you audit the current upstream SKILL.md content against the locked commit SHAs in your skills.lock file. This process identifies when tracked skills have changed, been deleted, or become unreachable.

Automating security scanning for dependency drift involves checking imported skills for security regressions using a FAIL, WARN, or PASS gating mechanism. The scan prioritizes triage by ranking findings based on whether the skill is currently enabled.

To prevent an autonomous agent from running on outdated skills, you audit upstream changes against locked versions in skills.lock. This operator-controlled trust model never auto-advances commit SHAs, requiring explicit acceptance via ACCEPT mode after re-scanning.

Yes, you can check for breaking changes in commit history before updating a skill by scanning commit messages for breaking-change signals. This diff impact computation helps determine if upstream modifications pose operational readiness risks.

YAML frontmatter diffing helps with operational triage for unattended agents by detecting exact metadata changes in upstream SKILL.md files. Combined with GitHub API SHA comparison, it produces decision-ready reports for scheduled maintenance.

Dependency drift scanning prioritizes certain skills over others through enabled-state aware prioritization. It ranks findings by whether the skill is currently enabled in aeon.yml, ensuring critical risks bubble to the top even if multiple skills drift.