Installed Skill Auditor

What it does

skill-vetting scans before install. installed-skill-auditor scans after — continuously.

Skills can be modified after installation. A community skill that was safe on Monday can be compromised by Tuesday if the source repo is pushed to and your agent auto-pulls. This skill runs weekly to catch post-install drift: injected payloads, hardcoded credentials, and pattern changes that weren't there at install time.

It maintains a content hash of every skill file at the time it was first audited. On each weekly run it re-hashes and flags anything that changed unexpectedly.

When to invoke

• Automatically, every Monday at 9am (cron)
• Manually after any git pull that touches skill directories
• After any agent action that writes to the skills tree

Audit checks

| Check | What it detects |