skills-update

# Skills Update Refresh externally installed skills listed in [`skills-lock.json`](../../../skills-lock.json). Installed copies live under [`.agents/skills/`](../../). Invocation is **explicit only** - do not update skills unless the user requests it. ## Hard rules - **Never** run `npx skills update` without at least one skill name. A bare update installs or refreshes every discoverable skill and pollutes `.agents/skills/` with unwanted content. - **Never** run `npx skills add <source>` without `--skill <name>`. A bare add installs every skill from the source repo and pollutes `.agents/skills/`. - **Never** run `npx skills add` unless the user explicitly requests a new skill or a legacy refresh (see below). - **Only** update skill names present as keys in `skills-lock.json`. - **One skill name per `npx` invocation.** Do not batch multiple skills in a single command unless the user explicitly names them. - Run all commands from the **repository root**. - Network access is required. ## Workflow 1. Read `skills-lock.json` and collect `Object.keys(skills)` - this is the authoritative list. Do not rely on a stale embedded list. 2. For each name, run a **separate** command: ```bash npx skills update <skill-name> ``` 3. If a skill reports **“cannot be updated automatically (installed before skillPath tracking)”**, re-add it from its lockfile `source` with `--skill`: ```bash npx skills add <source> --skill <skill-name> -y ``` Example: ...