[Skills] Fix silent skill auto-update on load

[DaleSeo]

Description

Fixes #27247

The Manage Skills command is silently reinstalling outdated skills on every open. This is happening because skills CLI v1.5.0 combined the check, update, and upgrade subcommands into one code path. Now, when you run npx skills check, it performs the update as a side effect instead of just reporting it. I filed an issue in vercel-labs/skills#954 upstream, but we need a short-term fix for the extension to avoid confusion.

This PR replaces the skills check invocation with a direct comparison against the GitHub Trees API. There are no CLI side effects, and it works no matter what the CLI does in future versions.

Testing

It's a bit tricky to test the changes if none of your skills are outdated. To simulate an outdated install, you should open ~/.agents/.skill-lock.json and change any skill's skillFolderHash to 40 zeros like "skillFolderHash": "0000000000000000000000000000000000000000".

Screencast

• Before updating

• After updating

Checklist

• I read the extension guidelines
• I read the documentation about publishing
• I ran npm run build and tested this distribution build in Raycast
• I checked that files in the assets folder are used by the extension itself
• I checked that assets used in the README are located outside the metadata folder if they were not generated with our metadata tool

[raycastbot]

Thank you for your contribution! 🎉

🔔 @keito4 @raulgg @pernielsentikaer you might want to have a look.

You can use this guide to learn how to check out the Pull Request locally in order to test it.

📋 Quick checkout commands

BRANCH="skills/fix-silent-auto-update"
FORK_URL="https://github.com/DaleSeo/extensions.git"
EXTENSION_NAME="skills"
REPO_NAME="extensions"

git clone -n --depth=1 --filter=tree:0 -b $BRANCH $FORK_URL
cd $REPO_NAME
git sparse-checkout set --no-cone "extensions/$EXTENSION_NAME"
git checkout
cd "extensions/$EXTENSION_NAME"
npm install && npm run dev

We're currently experiencing a high volume of incoming requests. As a result, the initial review may take up to 10-15 business days.

[greptile-apps]

Greptile Summary

This PR fixes a regression introduced in skills CLI v1.5.0 where calling skills check silently reinstalled outdated skills as a side effect, suppressing the "Update available" orange highlight. The fix replaces the CLI call with a direct GitHub Trees API comparison — reading the skill lock file's stored folder SHA and diffing it against the upstream tree SHA — without touching the CLI at all.

Confidence Score: 5/5

Safe to merge; all findings are P2 style/quality suggestions that do not affect correctness on the happy path.

The core bug fix is correct and well-scoped. Both remaining comments are P2: one is a style/convention note about the inline preference type (consistent with existing code in the same extension), and the other is a defensive edge case for very large repos that is unlikely in practice for skill repos.

extensions/skills/src/utils/skills-cli.ts — the new checkForUpdates implementation and fetchRepoTree helper.

Important Files Changed

Filename	Overview
extensions/skills/src/utils/skills-cli.ts	Replaces the CLI-based checkForUpdates (which triggered an unwanted reinstall side-effect) with a direct GitHub Trees API comparison; logic is sound with two minor P2 concerns: inline preference type and unhandled truncated tree response.
extensions/skills/CHANGELOG.md	New changelog entry added at the top with {PR_MERGE_DATE} placeholder and correct descending order — follows the standard changelog rules.

Prompt To Fix All With AI

This is a comment left during a code review.
Path: extensions/skills/src/utils/skills-cli.ts
Line: 266

Comment:
**Inline preference type — use the shared `preferences` object instead**

`getPreferenceValues` is already called with the auto-generated `Preferences` type in `preferences.ts`, which is the canonical approach for this extension. Calling it again here with a hand-written inline type both duplicates the read and diverges from that pattern.

```suggestion
  const { githubToken } = preferences;
```

Then add `import { preferences } from "../preferences";` at the top of the file.

**Rule Used:** What: Don't manually define `Preferences` for `get... ([source](https://app.greptile.com/review/custom-context?memory=d93fc9fb-a45d-4479-a6a4-b1b4af98ebc8))

How can I resolve this? If you propose a fix, please make it concise.

---

This is a comment left during a code review.
Path: extensions/skills/src/utils/skills-cli.ts
Line: 244-245

Comment:
**Truncated GitHub Trees API response not handled**

The GitHub Trees API sets `truncated: true` and omits entries when a repository's tree exceeds 100,000 items or 7 MB. When that happens, `entries.find(...)` silently returns `undefined` for any skill folder not included in the partial response, causing `upstreamSha` to be `undefined` and skipping the update check — a silent false negative.

Consider checking `tree.truncated` and treating those skills as unchecked (e.g., skipping them or falling back gracefully):

```typescript
if (res.ok) {
  const data = (await res.json()) as GitHubTreeResponse;
  if (data.truncated) return null; // can't reliably compare; skip
  return data;
}
```

How can I resolve this? If you propose a fix, please make it concise.

_{Reviews (1): Last reviewed commit: "Merge branch 'main' into skills/fix-sile..." | Re-trigger Greptile}

[pernielsentikaer]

Looks good to me, approved 🔥

[github-actions]

Published to the Raycast Store:
https://raycast.com/keito4/skills

[raycastbot]

🎉 🎉 🎉

We've rewarded your Raycast account with some credits. You will soon be able to exchange them for some swag.