SkillDrift

Who it's for

Platform/DevOps teams and agencies that have installed 5-50 third-party agent skills into internal workflows; today they either never re-check updated skills after initial install or manually diff commits by hand.

The problem

time (manual diffing of every skill update across dozens of repos) and legal/security exposure (a silently updated skill gaining new file/network access is a breach-liability gap they can't currently show they monitor).

How to build it

GitHub App/CLI that watches configured skill sources (git repos or registry entries); on new commit/tag it runs a static diff plus an LLM-generated 'what changed and why it matters' summary, posts to Slack/email, and can block a CI merge check on high-risk changes.

How it makes money

platform/security teams at agencies and mid-size companies pay $49-199/month per org (tiered by number of monitored skills) because an unnoticed update gaining filesystem/network access is a breach-liability item they must demonstrate monitoring for, and manual git diffing doesn't scale past a handful of skills or catch subtle instruction-override phrasing.

Why it doesn't exist yet

the SKILL.md format only became a visible ecosystem this week (anthropics/skills trending today), so no dependency-scanning tooling has caught up yet — mirroring the multi-year gap before Snyk/Socket.dev emerged for npm; marketplace operators have no incentive to police third-party supply-chain risk on their own platform.

First users

post in the anthropics/skills GitHub discussions and dev Discords right as the repo is trending, offering free drift scans on teams' currently-installed skill lists.

Build size

2 people x 10 weeks — includes repo/version watcher, diff engine, LLM risk-summary, Slack/email alert, basic dashboard; excludes running/executing the skill itself, marketplace hosting, and automated blocking beyond flagging.

Biggest risk

Anthropic or a marketplace operator ships native skill version-pinning plus changelog risk flags directly into the skills platform, making third-party drift-monitoring redundant.

Conditions for a hit (all 3 required)

• Diff report generated within 24h of any watched skill's source repo pushing a new commit or tag
• Each report lists concrete flagged changes (new external URL called, new file path accessed, new imperative instruction phrase) with exact line numbers
• Slack/email alert plus optional CI-blocking check triggered on any skill matching a preset high-risk pattern

How it's judged (in 6 months)

GitHub repo reaching 300+ stars or Product Hunt daily top 5(judgment date 2027-02-14)

AI self-confidence 42/100 — self-reported likelihood of meeting the criterion, not a business success rate