irekrog/skills-check-updates

No problems traced to this repository code in these checks. 6 static matches retained as context.

Reviewed as expected for a test run: attempted writes that failed, so nothing was written.

6 download and execute matches retained as context; full list in the evidence.

OSV scanned supported lockfiles; unpinned dependencies and unsupported formats are outside this check.

A short run cannot establish that code is safe.

Connections show IP addresses; proxies can hide the final hostname.

Tracing covers dispatched commands and their children, not the whole OS; guest root can interfere with tracing.

Full safety evidence →

• scu checks each skill in skills-lock.json against its GitHub source: Real input produced the expected result: not-installed

  Source: compares every skill with its GitHub source and reports what changed

  Input: project with skills-lock.json listing mattpocock/skills tdd

  Expected: tdd is listed with its upstream status

  Command: <guest-path> --cwd <guest-path> --json

  Observed: not-installed", "installSource": "mattpocock/skills/skills/engineering/tdd", "url": "https://github.com/mattpocock/skills/tree/HEAD/skills/engineering/tdd", "hasStalePath": false } ]

• scu --json prints a machine-readable report: Real input produced the expected result: "status": "not-installed"

  Source: scu --json # machine-readable report

  Input: project with skills-lock.json listing mattpocock/skills tdd

  Expected: JSON report with tdd status

  Command: <guest-path> --cwd <guest-path> --json

  Observed: "status": "not-installed", "installSource": "mattpocock/skills/skills/engineering/tdd", "url": "https://github.com/mattpocock/skills/tree/HEAD/skills/engineering/tdd", "hasStalePath": false } ]

Examples

• Development: offline test suite passes: command completed successfully

  Source: README.md Development section (pnpm test)

  Input: pnpm test

  Expected: all node --test cases pass

  Command: pnpm test

  Observed: rge was not planned for --- duration_ms: 82.075011 type: 'test' ... # Subtest: should restore the previous version when the lock is unreadable after installing ok 4 - should restore the previous version when the lock is unreadable after installing --- duration_ms: 83.051335 type: 'test' ... 1..4 ok 42 - upgradeSkill installed version check --- duration_ms: 315.443158 type: 'suite' ... 1..42 # tests 185 # suites 42 # pass 185 # fail 0 # cancelled 0 # skipped 0 # todo 0 # duration_ms 10233.783964 $ node --test "src/**/*.test.ts"

• Usage: scu --json machine-readable report on the documented lock file: command completed successfully

  Source: README.md Usage (scu --json)

  Input: --cwd <guest-path> --json

  Expected: JSON report listing tdd

  Command: <guest-path> --cwd <guest-path> --json

  Observed: [ { "name": "tdd", "status": "not-installed", "installSource": "mattpocock/skills/skills/engineering/tdd", "url": "https://github.com/mattpocock/skills/tree/HEAD/skills/engineering/tdd", "hasStalePath": false } ]

Local or hosted: local

Check skills listed in skills-lock.json for newer upstream versions with scu (skills-check-updates), report-only, JSON output

cd <guest-path> && pwd && ls -la && git status 2>&1 | head -3; id -u; python3 --version; cat README.md 2>/dev/null | head -150
cd <guest-path> && find . -path ./.git -prune -o -type f -print | head -100; echo; echo CDP:; curl -s -m 10 -w '\nHTTP %{http_code}\n' $CDP_URL/json/version
cd <guest-path> && tail -c +10000 README.md | head -c 4000; echo ----; cat package.json; echo ----; node -v; npm -v; which pnpm uv 2>&1
cd <guest-path> && head -c 10000 README.md | tail -c 5200 | head -c 3500; echo; echo ----; curl -s -o /dev/null -m 10 -w 'github %{http_code}\n' https://api.github.com/ ; curl -s -o /dev/null -m 10 -w 'npm %{http_code}\n' https://registry.npmjs.org/
cd <guest-path> && export NODE_USE_ENV_PROXY=1 && pnpm install 2>&1 | tail -20; echo "exit=$?"
cd <guest-path> && pnpm build 2>&1 | tail -15; echo "exit=${PIPESTATUS[0]}"; ls dist 2>&1 | head; 
cd <guest-path> && timeout 600 pnpm test 2>&1 | tail -12; echo "exit=${PIPESTATUS[0]}"
cd /tmp && npm install -g --prefix <guest-path> <guest-path> 2>&1 | tail -5; ls -la <guest-path> ; <guest-path> --help 2>&1 | head -40
cd <guest-path> && sed -n 1,80p src/lock.ts; grep -rn "skillPath\|sourceType" src/test-helpers.ts | head; ls docs; grep -rn "skills-lock" README.md | head -5
mkdir -p <guest-path> && cd <guest-path> && cat > skills-lock.json <<'EOF'
{
  "version": 1,
  "skills": {
    "tdd": {
      "source": "mattpocock/skills",
      "sourceType": "github",
      "skillPath": "skills/engineering/tdd/SKILL.md",
      "computedHash": "0000000000000000000000000000000000000000000000000000000000000000"
    }
  }
}
EOF
<guest-path> --cwd <guest-path> --details 2>&1 | head -40; echo "exit=${PIPESTATUS[0]}"
cd <guest-path> && <guest-path> --cwd <guest-path> --json 2>/dev/null | head -c 1500; echo; echo "exit=${PIPESTATUS[0]}"
cd <guest-path> && grep -nF 'npm install -g skills-check-updates' README.md; grep -nF 'compares every skill with its GitHub source' README.md; grep -nF 'scu --json     # machine-readable report' README.md; grep -nF 'scu --json' README.md | cat -A | head -3; echo ---; grep -rniE 'setInterval|cron|schedul|watch\(' src/*.ts | grep -v test | head
mkdir -p <guest-path> && cd <guest-path> && cat > probe.json <<'EOF'
{"kind":"cli","argv":["<guest-path>","--cwd","<guest-path>","--json"],"cwd":"<guest-path>","env":{},"expected_text":"not-installed"}
EOF
cat > claims.json <<'EOF'
[
{"kind":"claim","claim":"scu reports on each skill in skills-lock.json compared with its GitHub source","source":"README.md","quote_source":"README.md","source_file":"README.md","input":"project with skills-lock.json listing mattpocock/skills tdd","expected":"tdd is listed with its upstream status","probe_kind":"cli","argv":["<guest-path>","--cwd","<guest-path>","--json"],"cwd":"<guest-path>","env":{},"expected_text":"not-installed"},
{"kind":"claim","claim":"scu --json prints a machine-readable report","source":"README.md","input":"project with skills-lock.json listing mattpocock/skills tdd","expected":"JSON report with tdd status","probe_kind":"cli","argv":["<guest-path>","--cwd","<guest-path>","--json"],"cwd":"<guest-path>","env":{},"expected_text":"\"status\": \"not-installed\""}
]
EOF
python3 -I -c 'import json;json.load(open("probe.json"));json.load(open("claims.json"));print("ok")'
cd <guest-path> && cat > claims.json <<'EOF'
[
{"kind":"claim","claim":"scu checks each skill in skills-lock.json against its GitHub source","source":"compares every skill with its GitHub source and reports what changed","input":"project with skills-lock.json listing mattpocock/skills tdd","expected":"tdd is listed with its upstream status","probe_kind":"cli","argv":["<guest-path>","--cwd","<guest-path>","--json"],"cwd":"<guest-path>","env":{},"expected_text":"not-installed"},
{"kind":"claim","claim":"scu --json prints a machine-readable report","source":"scu --json     # machine-readable report","input":"project with skills-lock.json listing mattpocock/skills tdd","expected":"JSON report with tdd status","probe_kind":"cli","argv":["<guest-path>","--cwd","<guest-path>","--json"],"cwd":"<guest-path>","env":{},"expected_text":"\"status\": \"not-installed\""}
]
EOF
cat > examples.json <<'EOF'
[
{"kind":"example","claim":"Development: offline test suite passes","source":"README.md Development section (pnpm test)","input":"pnpm test","expected":"all node --test cases pass","argv":["pnpm","test"],"cwd":"<guest-path>","env":{},"expected_text":"# fail 0"},
{"kind":"example","claim":"Usage: scu --json machine-readable report on the documented lock file","source":"README.md Usage (scu --json)","input":"--cwd <guest-path> --json","expected":"JSON report listing tdd","argv":["<guest-path>","--cwd","<guest-path>","--json"],"cwd":"<guest-path>","env":{},"expected_text":"\"name\": \"tdd\""}
]
EOF
cat > cycles.json <<'EOF'
{"detected":false,"reason":"Inspected README, package.json bin entries (scu -> dist/cli.js) and src/*.ts (no setInterval, cron, scheduler, watch or webhook code). scu runs once per invocation; --exit-code is a CI exit status, not a product cycle.","checks":[]}
EOF
python3 -I -c 'import json;[json.load(open(f)) for f in ["claims.json","examples.json","cycles.json","probe.json"]];print("ok")'
ls -la <guest-path> /inputs/ 2>&1 | head -20
cd <guest-path> && <env-var>=<guest-path> timeout 900 python3 -I <guest-path> --validate --replay 2>&1 | tail -60; echo "exit=${PIPESTATUS[0]}"
cd <guest-path> && cat > report.json <<'EOF'
{"outcome":"working","fault_owner":null,"operation":"Check skills listed in skills-lock.json for newer upstream versions with scu (skills-check-updates), report-only, JSON output","operation_scope":"Node >=22.18 (guest has v22.23.4, npm 10.9.9, pnpm 12.15.0), GitHub network access. Fixture project <guest-path> with one lock entry (mattpocock/skills tdd). No local skill copy installed, so status is not-installed. No credentials or browser needed.","steps":["curl $CDP_URL/json/version -> HTTP 200 (Chrome/155.0.8059.84); not used, product is CLI-only","pnpm install (README Development) -> exit 0, 4 packages added","pnpm build (README Development) -> exit 0, dist/ written","pnpm test (README Development) -> 185 tests, 0 failing","npm install -g --prefix <guest-path> <guest-path> -> scu and skills-check-updates bins linked to dist/cli.js","scu --help -> exit 0 (setup check)","scu --cwd <guest-path> --details -> tdd not installed, 0 skills up to date","scu --cwd <guest-path> --json -> JSON report with name tdd, status not-installed (probe and claims)","<env-var>=<guest-path> python3 -I <guest-path> --validate --replay -> valid, replay PASS"],"deviations":["Installed scu from the pinned checkout with npm install -g --prefix into a user-local prefix, not the published npm package from the README Installation section, so the tested code is the snapshot.","Ran scu via absolute path <guest-path> because the prefix is not on PATH.","Used a fixture project (<guest-path>) with a hand-written skills-lock.json, because the snapshot has no lock file. The computedHash is a dummy value; the result does not test update detection or installs.","Not run: scu -u / --force (would modify skills), --scan (needs SkillSpector, uv tool install from GitHub, not done), --ui (opens a browser; browser use was not allowed beyond the CDP endpoint check), --min-age and --exit-code (no update to hold back)."],"stuck_step":null,"main_blocker":null,"plain_failure":null,"suggested_fix":null}
EOF
python3 -I -c 'import json;d=json.load(open("report.json"));print(d["outcome"])'; ls -la <guest-path>; ls <guest-path> | grep -c '^report.json$'