The Agent Skills Directory

[Skill Update Mechanism]: The skill manages the lifecycle of extensions by fetching updates from remote registries. It specifically uses immutable commit SHAs rather than mutable tags to ensure integrity.
[Filesystem Access]: It reads and writes to specific configuration and skill directories (~/.claude/). This is standard behavior for a package manager and includes a backup/rollback mechanism for safety.
[Indirect Prompt Injection Surface]: The skill processes untrusted update data from external registries. Evidence Chain: (1) Ingestion point: Skill files and metadata fetched from source registries. (2) Boundary markers: Mandatory human diff review and automated GlassWorm gate. (3) Capability inventory: Subprocess execution via skills-qa scan and filesystem write access for updates. (4) Sanitization: Human-in-the-loop verification of all diffs and restricted subagent scanning.
[Human-in-the-Loop Review]: It enforces a mandatory manual review of diffs for security-sensitive files like hooks.json or .mcp.json, ensuring that no code or permission changes occur without explicit user consent.

auto-updater