What problem does it solve? Keeping locally installed AI agent skills in sync with their upstream GitHub sources is risky: upstream content is untrusted, licenses may block reuse, and blind updates can overwrite intentional local changes. This Skill provides a controlled, read-only-first lifecycle for discovering, comparing, and safely adapting external skill updates. ## Core Features & Use Cases - Read-only upstream audit: Resolve tags and branches to immutable commit SHAs, compare upstream revisions against locally pinned versions, and classify each source as unchanged, update-available, untracked, incompatible, license-blocked, or check-blocked. - Approval-gated adaptation: Require an Owner-approved Work Block naming the exact repository, SHA, destination files, license disposition, and rollback path before any content is copied or modified. - Provenance tracking: Record source URL, immutable SHA, license evidence, local delta, and decisions in a structured provenance record, with a priority source catalog (OpenAI Codex, then Anthropic Skills) and an opt-in ecosystem watchlist. - Use Case: A maintainer suspects a tracked design skill has upstream improvements. The Skill checks the pinned revision against the resolved upstream SHA, reports the diff and license status, and only adapts the update after explicit Owner approval. ## Quick Start Use skill-library-maintenance to check my tracked GitHub skill sources for updates and report which ones have newer upstream revisions.
