cli-upgrade

The skill's footprint is coherent with its stated purpose: it collects non-sensitive user input, relies on official release sources to fetch version data, and outputs plain-language summaries with source references. There are no credentials, no suspicious download/install chains, and no data exfiltration patterns evident. The security posture appears benign with moderate trust required in external sources; no unusual permissions or third-party binaries are involved.