What should happen when an installed skill changes?
Check first, then decide whether to upgrade. Distinguish cloud skill releases, npm client updates and security revocations.
Maintained · Product guidance, not an external skill evaluation
Checking must not change the selected release
A read-only update check compares the project lock with qualified cloud releases and reports versions, notes and compatibility. Ordinary results can be cached for 24 hours; explicit checks refresh them. Revocations are checked separately. Offline reports disclose unknown status or cache time.
skillflux check-updates --project .Approve an exact target before updating
Review release notes and breaking changes, then choose an exact target. The plan fixes that target and verification runs again before installation. Non-interactive commands need explicit confirmation; MCP executes a specified plan rather than interpreting an available release as permission to update.
Pin releases for reproducible projects
Pinned releases still appear in update reports but cannot be silently replaced. Explicitly unpin before upgrading. The client preserves user edits, keeps the current lock on failure, and only rolls back to releases that remain safe and available.
Update checks are not offline push notifications
Website release notes serve all visitors; local MCP reports changes relevant to the project. Nothing is pushed while the application is stopped, and notification display depends on host support. Cloud skill updates do not normally require reinstalling npm; client feature changes do.