Skill Update

SKILL.md preview

---
name: Skill Update
description: Check imported skills for upstream changes and security regressions since the version in skills.lock
var: ""
tags: [dev, security]
cron: "0 19 * * 0"
---
> **${var}** — Skill name to check. If empty, checks all skills tracked in `skills.lock`. Special form `accept:{skill_name}` advances the lock for that skill to the current upstream SHA after re-running the security scan (use only after manual review of the diff).

<!-- autoresearch: variation B — sharper output: priority verdict + decision-ready triage + enabled/disabled cross-reference -->

Today is ${today}. Audit imported skills for upstream changes since installation, classify each by drift size × security verdict × downstream impact (whether the skill is enabled in `aeon.yml`), and lead with a one-line verdict so the operator knows what to act on. The goal is decision-ready triage, not a flat catalog of SHAs.

## Steps

### 1. Preflight + scope

- Read `skills.lock` at the repo root.
  - If missing or empty: log `SKILL_UPDATE_CHECK_NO_LOCK: skills.lock not found — no imported skills tracked` to `memory/logs/${today}.md` and stop. Do NOT notify.
  - Each entry has the shape:
    ```json
    {
      "skill_name": "bankr",
      "source_repo": "BankrBot/skills",
      "source_path": "skills/bankr/SKILL.md",
      "branch": "main",
      "commit_sha": "abc1234...",
      "imported_at": "2026-04-01T12:00:00Z"
    }
    ```
- If `${var}` starts with `accept:`, parse the skill name suffix and switch to ACCEPT mode (jump to step 9). Skip drift detection.
- If `${var}` is non-empty (and not `accept:...`), filter the lock to that one entry. If no match, log `SKILL_UPDATE_CHECK_NO_MATCH: ${var} not in skills.lock` and stop.
- Read `aeon.yml` and build a set `ENABLED` of skill names where the entry has `enabled: true`. This drives the priority calculation in step 5.

### 2. Per-skill drift detection

For each entry, fetch the latest upstream commit SHA for the locked source path **on the tracked branch**:
```bash
gh api "repos/${source_repo}/commits" -f path="${source_path}" -f sha="${branch}" -f per_page=1 \
  --jq '.[0] | if . == null then "MISSING" else {sha: .sha, message: .commit.message, date: .commit.author.date, author: .commit.author.name} end'
```
The `-f sha="${branch}"` constraint is required: the `commits` API defaults to the repository's default branch, so skills locked to a non-default branch (e.g. `release`, `develop`) would otherwise be compared against the wrong history and produce false `UP-TO-DATE` / `CHANGED` results.
- If output is `"MISSING"`, classify status as `MISSING_UPSTREAM` (file deleted or path renamed upstream — treat as a security signal in step 5).
- If the API call fails:
  - On `429` or `5xx`: wait 60 seconds and retry once. If still failing, mark `UNREACHABLE` for this run.
  - On `404` (repo deleted/private): mark `UNREACHABLE`.
  - Record the failure type in the source-status footer.

Compare the returned SHA to the locked `commit_sha`. Equal → `UP-TO-DATE`. Different → `CHANGED`.

### 3. Per-changed-skill enrichment

For each `CHANGED` skill, fetch the compare metadata between locked and current SHAs:
```bash
gh api "repos/${source_repo}/compare/${locked_sha}...${current_sha}" \
  --jq '{ahead_by, total_commits, files: [.files[] | {filename, status, additions, deletions, patch}], commits: [.commits[] | {sha: (.sha[0:7]), message: .commit.message, author: .commit.author.name, date: .commit.author.date}]}'
```

From this, compute:

- **diff_size**: `additions + deletions` for the SKILL.md row only → `TRIVIAL` (≤5), `SMALL` (≤20), `MEDIUM` (≤100), `MAJOR` (>100). Other files in the change-set are listed but do not drive the size class.
- **breaking_keywords**: scan all commit messages for any of `BREAKING CHANGE`, `BREAKING:`, `breaking change`, `incompat`, `deprecate`, `remove`, `rewrite`, `replace`. Record the matches.
- **frontmatter_diff**: parse the YAML frontmatter of locked vs current SKILL.md and diff 

…