Diff Auditor

This skill appears to do what it says: it reads your installed SKILL.md and fetches the remote SKILL.md on ClawHub, then compares tool lists and reports a verdict. Before installing or relying on it, consider these points: - Blind spots: it only inspects SKILL.md. Updates that introduce new endpoints, credentials, or behaviors inside code files, scripts, or bundled assets will be missed — the free/lite version explicitly won't report new external endpoints. For high-risk environments, manually review the updated package or use tools that inspect code files, not just SKILL.md. - Trust and provenance: registry metadata shows no homepage/source; verify the publisher (ordo-tech) and the ClawHub URLs used to fetch remote SKILL.md before trusting reports. An attacker could spoof or publish malicious SKILL.md on a registry under an unfamiliar account. - Operational caution: do not rely solely on the free report for updates that add sensitive tools (exec, write, network access). If an update adds exec/write or similar, perform a thorough code review or use the 'full' audit capability the author advertises (or other auditing tools) before approving. If you need higher assurance, request/require an auditor that scans all package files (not just SKILL.md) and validates remote content authenticity (signed releases or trusted publisher verification).