pkg-update 100/100 — SaferSkills

Is pkg-update safe to install?

SaferSkills independently audited pkg-update (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.

CategoryWeightCategory scoreContribution

Securityprompt, exec, net, exfil, eval

35%

100

35.0 pts

Supply chainhash, typosquat, maintainer, lockfile

20%

100

20.0 pts

Maintenancestaleness, pinning, CI

15%

100

15.0 pts

TransparencySKILL.md, perms, README

15%

100

15.0 pts

Communityinstalls, verify, response

15%

100

15.0 pts

Findings & checks · 0 flagged

Securityscore 100 · 0 findings

✓—All security checks passedNo findings in this category for the latest scan.pass

Supply chainscore 100 · 0 findings

✓—All supply chain checks passedNo findings in this category for the latest scan.pass

Maintenancescore 100 · 0 findings

✓—All maintenance checks passedNo findings in this category for the latest scan.pass

Transparencyscore 100 · 0 findings

✓—All transparency checks passedNo findings in this category for the latest scan.pass

Communityscore 100 · 0 findings

✓—All community checks passedNo findings in this category for the latest scan.pass

The primary manifest — the file an agent reads to learn what this artifact does.

packages/aur-package-management/.apm/skills/pkg-update/SKILL.md · 1 file

packages/aur-package-management/.apm/skills/pkg-update/SKILL.md2.0 KB · Markdown

name: pkg-update

description: Update an Arch Linux package to a new upstream version. Use when a package version has changed, nvchecker reports a delta, oldver.json is stale, the user asks to update/sync/upgrade a package, or a version bump is needed — even if the user doesn't explicitly mention "PKGBUILD" or "sync-package.sh."

allowed-tools: bash

compatibility: Requires bash, namcap, makepkg, pkgctl, and nvtake. Designed for the pngdeity aur repository.

Package Update Workflow

When updating a package to a new upstream version:

Run the sync script:

   bash scripts/sync-package.sh <pkgname> <version>

This performs the hybrid merge with upstream, applies update.sh, and updates hashes.

Lint the result:

   namcap PKGBUILD

Fix any issues before proceeding.

Regenerate metadata:

   makepkg --printsrcinfo > .SRCINFO

Build in a clean chroot:

   pkgctl build

This verifies the package compiles and passes check() in an isolated environment.

Sanity check the payload:

   pkgctl diff --list

Verify the primary binary, license file, and directory structure are intact. A payload size deviation of >10% or disappearance of /usr/bin/ targets must be investigated.

Acknowledge the update:

   nvtake <pkgname>

Refer to the Debian nvtake manual for flags. Do not hallucinate options.

Commit PKGBUILD and .SRCINFO together in a single commit. Use the format <pkgname>: update to <version>.

Gotchas

pkgctl build may require a pre-configured chroot. If missing, set up with mkarchroot.
If updpkgsums fails due to a re-rolled upstream tarball, verify the file content before accepting new hashes.
If the sync-package.sh merge produces conflicts, manual intervention is required. Hybrid merge conflict recovery is not yet automated (see docs/TODO.md).

pkg-update— agent skill

Is pkg-update safe to install?

Package Update Workflow

Gotchas

Audit the pieces. Scan the whole. Decide.