install-then-update-trap-detector

# The Skill Passed Audit. Then It Updated Itself.

> Helps identify skills that use the post-install update window as an attack
> vector — the gap between "passed initial review" and "continuously safe."

## Problem

The install-then-update pattern exploits a structural asymmetry in how agent
marketplaces work: initial publication receives scrutiny, but subsequent
updates often do not. A skill that passes a thorough security review at v1.0
can introduce a backdoor at v1.1 — and agents that installed v1.0 may
automatically update without any re-review occurring.

This asymmetry is not a bug in any particular marketplace. It reflects a
fundamental tension between two legitimate goals: fast iteration (which
requires low-friction updates) and continuous security (which requires
re-audit on every change). Most marketplaces resolve this tension in favor
of iteration speed, leaving the post-install update window unguarded.

The attack surface is large. An installed skill with automatic updates
enabled can receive arbitrary code changes at the next update check. If the
update introduces network exfiltration, credential harvesting, or permission
scope expansion, the agent operator may not learn about it until after
the damage is done — if they learn at all.

## What This Detects

This detector examines the install-then-update risk surface across five
dimensions:

1. **Update policy transparency** — Does the skill declare its update
   policy? Skills that accept automatic updates without operator confirmation
   have a larger attack window than those requiring explicit approval

2. **Behavioral delta on update** — When a new version is installed, does
   the skill's observable behavior change in ways not declared in the
   changelog? Undeclared behavioral changes after update are the primary
   signal of install-then-update exploitation

3. **Permission scope expansion on update** — Does the skill request
   additional permissions after...