upgrade

The skill legitimately performs a local upgrade but requires executing a local Node CLI and re-printing its output, which together present moderate-to-high security risk. Primary concerns: arbitrary code execution at user privilege, supply-chain tampering during git/npm operations, and exposure or prompt-injection via unfiltered CLI output. Mitigations before running: require explicit user confirmation, run the upgrade in a sandboxed/least-privileged environment, pin/verify remote artifacts, and sanitize or redact CLI output before re-displaying. If those safeguards cannot be implemented, avoid executing this upgrade as-is.