auditing-declared-vs-used-permissions

# Auditing declared versus used permissions: the consent gap is the bug A user grants a skill the permissions it asks for. The question no one checks is whether it needs them. A skill that requests shell access and never shells out, or network access and never makes a call, has widened the user's blast radius for nothing, and a compromise or a later update inherits that headroom. Worse is the other direction: a skill that acts beyond what it declared. This skill measures the gap between the grant and the use, in both directions. ## When to use - You are reviewing a skill, an MCP server, or a marketplace entry before install. - You are auditing least privilege across an agent's installed skills and tools. - You want to right-size a grant, not just confirm the artifact runs. ## Scope check Audit skills and servers you own or are authorized to review. Inspect the bundled code statically; run it only in a contained environment. If you can't name the authorization, stop. ## The loop 1. **Read the declared permission surface.** Collect exactly what the artifact asks for: the allowed-tools or capability list in frontmatter or manifest, the scopes it requests, the network, filesystem, and process access it declares. This is the consent the user is asked to give. Record it as the grant set. 2. **Inventory what the code and instructions actually exercise.** Walk the bundled scripts and the instruction text and record the real capabilities used: which tools are in...