skill-update-check

Audit imported skills for upstream drift and security regressions against locked commit SHAs.

6|2|Updated May 21, 2026

Search Tags:#automation #skills #security scanning #GitHub API #dependency drift #supply-chain safety #operations triage

Ready to run

npx skills add https://github.com/anajuliabit/aeon --skill skill-update-check-anajuliabit

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: skill-update-check
Source: https://github.com/anajuliabit/aeon/tree/main/skills/skill-update-check
Command: npx skills add https://github.com/anajuliabit/aeon --skill skill-update-check-anajuliabit

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

It prevents the autonomous agent from silently running on outdated or insecure imported skills by auditing upstream changes against the locked versions in skills.lock.

Core Features & Use Cases

Upstream drift detection: Detects when each tracked skill’s upstream SKILL.md has changed, been deleted, or become unreachable.
Decision-ready triage: Computes diff impact (including SKILL.md changes), scans commit history for breaking-change signals, and checks security verdicts (PASS/WARN/FAIL).
Enabled-state aware prioritization: Ranks findings by whether the skill is currently enabled in aeon.yml, so critical risks bubble to the top even if multiple skills drift.
Operator-controlled trust model: Never auto-advances commit SHAs; updates are either reported or explicitly accepted via ACCEPT mode after re-scanning.

Quick Start

Run the skill in audit mode with an optional target skill name to produce a priority-sorted report of upstream changes and security results.

Frequently Asked Questions about skill-update-check

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I detect upstream drift in imported GitHub skills?▼

To detect upstream drift in imported GitHub skills, you audit the current upstream SKILL.md content against the locked commit SHAs in your skills.lock file. This process identifies when tracked skills have changed, been deleted, or become unreachable.

What is the best way to automate security scanning for dependency drift?▼

Automating security scanning for dependency drift involves checking imported skills for security regressions using a FAIL, WARN, or PASS gating mechanism. The scan prioritizes triage by ranking findings based on whether the skill is currently enabled.

How do I prevent an autonomous agent from running on outdated skills?▼

To prevent an autonomous agent from running on outdated skills, you audit upstream changes against locked versions in skills.lock. This operator-controlled trust model never auto-advances commit SHAs, requiring explicit acceptance via ACCEPT mode after re-scanning.

Can I check for breaking changes in commit history before updating a skill?▼

Yes, you can check for breaking changes in commit history before updating a skill by scanning commit messages for breaking-change signals. This diff impact computation helps determine if upstream modifications pose operational readiness risks.

Does YAML frontmatter diffing help with operational triage for unattended agents?▼

YAML frontmatter diffing helps with operational triage for unattended agents by detecting exact metadata changes in upstream SKILL.md files. Combined with GitHub API SHA comparison, it produces decision-ready reports for scheduled maintenance.

Why does dependency drift scanning prioritize certain skills over others?▼

Dependency drift scanning prioritizes certain skills over others through enabled-state aware prioritization. It ranks findings by whether the skill is currently enabled in aeon.yml, ensuring critical risks bubble to the top even if multiple skills drift.