Skill Update

Safely update skills with preview, migration support, and user validation. Never lose data or break workflows.

Security Scan

The skill is internally consistent: it is an instruction-only helper for previewing, backing up, migrating, and applying skill updates and its actions match that purpose.

Purpose & Capability

Name/description match the instructions: the files describe checking for updates, creating previews, taking backups, performing migrations, and rolling back. There are no unrelated required env vars, binaries, or config paths that don't belong to an updater tool.

Instruction Scope

The runtime instructions explicitly direct the agent to read and write skill folders, copy backups to ~/.clawhub/backups/, inspect SKILL.md and other files, and run npx clawhub commands to fetch versions. These actions are coherent with an update/migration tool but do require file-system access and network fetches — the user should be aware the agent will read and modify local skill data when performing updates or migrations.

Install Mechanism

No install spec or code is included (instruction-only). The docs reference npx clawhub fetch/info/outdated which will cause network downloads when run; this is expected for fetching skill updates but means the actual fetch/install step pulls from npm/registry at runtime rather than being bundled with the skill files.

Credentials

The skill requests no credentials, env vars, or config paths. Its suggested filesystem targets (e.g., ~/.clawhub/backups and ~/.clawhub/skills/<slug>) are appropriate for a skill-management tool and proportionate to the stated purpose.

Persistence & Privilege

always:false and normal autonomous invocation are set. The skill does instruct making backups and modifying skill files, but it does not request elevated privileges or to persist beyond its own operations. Nothing indicates it modifies other skills' configs beyond performing backups/migrations on the target skill as intended.

Assessment

This skill is an updater-style instruction bundle and will read and modify local skill folders, create backups under ~/.clawhub/backups/, and use npx clawhub to fetch versions (network downloads at runtime). Before using it: (1) ensure you trust the source of clawhub packages and the registry you will fetch from, (2) verify you are comfortable allowing the agent to read/write your ~/.clawhub/skill directories, (3) confirm backups are stored where you expect and review them before deletion, and (4) consider asking the agent to show the preview/diff and request explicit approval before applying changes. If you prefer manual control, do the fetch/inspect/restore steps yourself rather than allowing autonomous updates.

Safe Skill Updates

Core principle: Never update without user understanding and approval.

Updates can break things:

• Changed file locations → data loss
• Removed features → broken workflows
• New requirements → unexpected behavior
• Changed data formats → incompatible state

References:

• Read preview.md — Diff and impact analysis
• Read migrate.md — Data migration strategies

---

Update Flow

1. Check — Are updates available?
2. Preview — What changes? How does it affect user?
3. Explain — Present changes step-by-step
4. Confirm — User explicitly approves
5. Backup — Save current state
6. Update — Apply new version
7. Verify — Confirm everything works

---

Checking for Updates

npx clawhub outdated           # List skills with updates
npx clawhub info <slug>        # Show available versions

Proactive notification: When user mentions a skill, check if update exists. Mention it once, don't nag.

---

Preview Before Update

⚠️ Never update without showing impact first.

For each changed file:

1. Show what's different (added/removed/modified)
2. Explain how it affects user's workflow
3. Flag breaking changes prominently

Breaking change indicators:

• File/folder structure changes
• Removed instructions or features
• New required setup steps
• Changed data format expectations

---

User Validation

Present changes in digestible format:

"Skill X has v2.0.0 available. Changes:

⚠️ Breaking: Config now in config.md (was in SKILL.md) Added: New templates/ folder with examples Removed: Old legacy.md no longer needed

Migration needed: Your saved preferences need to move. I can help migrate. Proceed?"

Only update after explicit "yes".

---

Backup Strategy

Before ANY update:

1. Copy current skill folder to ~/.clawhub/backups/<slug>-<version>-<timestamp>/
2. Note the backup location in response
3. If update fails → offer restore

---

Handling Migrations

When data format changes:

1. Detect user's current data (preferences, saved state)
2. Explain what needs to migrate
3. Propose migration steps
4. Execute only with approval
5. Verify migrated data works

See migrate.md for patterns.

---

Rollback

If update causes problems:

"Something's not working? I have a backup from before the update.
Want me to restore skill X to v1.2.3?"

Keep backups for at least 7 days or until user confirms new version works.

---

Updates should feel safe, not scary. User stays in control.