Is agent-reverse-update safe to install?

SaferSkills independently audited agent-reverse-update (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.

CategoryWeightCategory scoreContribution

Securityprompt, exec, net, exfil, eval

35%

100

35.0 pts

Supply chainhash, typosquat, maintainer, lockfile

20%

100

20.0 pts

Maintenancestaleness, pinning, CI

15%

100

15.0 pts

TransparencySKILL.md, perms, README

15%

100

15.0 pts

Communityinstalls, verify, response

15%

100

15.0 pts

Findings & checks · 0 flagged

Securityscore 100 · 0 findings

✓—All security checks passedNo findings in this category for the latest scan.pass

Supply chainscore 100 · 0 findings

✓—All supply chain checks passedNo findings in this category for the latest scan.pass

Maintenancescore 100 · 0 findings

✓—All maintenance checks passedNo findings in this category for the latest scan.pass

Transparencyscore 100 · 0 findings

✓—All transparency checks passedNo findings in this category for the latest scan.pass

Communityscore 100 · 0 findings

✓—All community checks passedNo findings in this category for the latest scan.pass

The primary manifest — the file an agent reads to learn what this artifact does.

skills/agent-reverse-update/SKILL.md · 1 file

skills/agent-reverse-update/SKILL.md1.5 KB · Markdown

name: agent-reverse-update

description: "Check for AgentReverse skill updates and Claude Code changelog changes on session start. Runs automatically via SessionStart hook — compares installed versions against remote, applies safe migrations, and flags breaking changes. Use when user says /agent-reverse-update to manually trigger an update check."

user-invocable: true

hooks:

SessionStart:

- type: command

command: |

if [[ -f agent-reverse.json ]]; then

RESULT=$(npx agent-reverse check-updates --json 2>/dev/null)

OUTDATED=$(echo "$RESULT" | jq '.outdated | length' 2>/dev/null)

[[ "$OUTDATED" -gt 0 ]] && echo "[AgentReverse] $OUTDATED update(s) available"

Agent Reverse Update

Checks for skill updates automatically on session start.

How It Works

On session start, this skill checks your agent-reverse.json manifest against the remote repos to see if any pinned commits have newer versions available.

Manual Check

To manually check and update:

Check for updates: Use manifest_check_updates MCP tool to see which skills have updates
View outdated: The tool returns outdated array with id, pinnedCommit, and latestCommit
Update all: Use manifest_sync MCP tool to reinstall all skills from latest commits

Example Usage

# Check updates
Use manifest_check_updates tool

# Sync to latest
Use manifest_sync tool

Suppressing Notifications

If you don't want session-start notifications, remove this skill from .claude/commands/.

agent-reverse-update— agent skill

Is agent-reverse-update safe to install?

Agent Reverse Update

How It Works

Manual Check

Example Usage

Suppressing Notifications

Audit the pieces. Scan the whole. Decide.