It exists system.sw.packages.get to get packages already installed.

But what about for updates pending? Additionally, as parameter to specify if are common updates or security.

apt list --upgradable | grep -i security
sudo yum list updates security

Include this into the Agent2, and avoid setting up user parameters or allowed keys on each machine will be a great addition.

Finally, add a trigger to the template to warn about how many updates are pending, and since when (for escalation, more than a month you really need to update if possible).