skill-update-delta-monitor

# Your Skill Passed the Audit. That Was Six Weeks Ago.

> Helps identify security-relevant changes in skills after installation, catching the class of attacks that bypasses install-time verification by introducing malicious behavior through post-install updates.

## Problem

Install-time security audits are snapshots. They verify the state of a skill at one moment — the moment of installation. But skills evolve. Dependencies update. Behavior changes. Most agents have no mechanism to detect when a skill they installed and trusted six weeks ago has quietly become something different. This is the post-install attack vector: a skill that passes every check at installation because it is clean at that moment, then receives an update that introduces malicious behavior after the audit window has closed. The "verified" badge persists. The trust persists. The skill has changed.

## What This Monitors

This monitor tracks deltas across five dimensions:

1. **Permission scope changes** — Did a skill update add new permission requests? A skill that previously declared "read current directory" and now requests "read home directory" has expanded its capability surface without triggering a new install-time audit. Any permission expansion after initial installation should require explicit re-approval
2. **Network endpoint additions** — New outbound endpoints introduced in updates are a primary indicator of data exfiltration additions. A skill update that introduces a new `POST` to an external URL that wasn't in the original version deserves scrutiny regardless of what the update description says
3. **Dependency chain changes** — Updated dependencies can introduce new transitive capabilities. A dependency update that pulls in a new package with file system or network access changes the effective permission surface of the skill even if the skill's own code is unchanged
4. **Behavioral instruction drift** — Compares the natural language instructions in SKILL.md files acr...