Home / Articles / A skill behaviour policy / Versions / v1.1.0
A skill behaviour policy: what changed in v1.1.0
From v1.0.0 (2026-10-14, 7f9533d32) to v1.1.0 (2026-10-27, db67c5ce1), paragraph by paragraph.
0 paragraphs added, 0 removed, 3 changed in place, 53 unchanged. About 0 words added and 131 removed. Insertions are marked like this, deletions like this; unchanged runs are folded to one line; figures appear as their file names.
2 unchanged paragraphs
!shot sb-three.webp | images/ | A skill behaviour policy: three mandates, two gaps,gaps and one control. What the description says, what the skill's files and instructions can do, and what the environment grants. Actual minus described is the suspicious part; grant minus actual is the reach nobody asked for; the control brings the grant down to the described mandate. | architecture
22 unchanged paragraphs, under In short {#in-short}, The claim, and what the study found {#claim}, Three mandates {#three}…
!shot sb-measured.webp | images/ | 899 skills from three public sources, every file read as text and nothing run:sources: what they can reach, and what their descriptions leave out. 812 can reach something beyond their own scripts, 782 of them through one third-party tool server; 39 have a feature their description does not mention; none was obfuscated, and none sets allowed-tools. | comparison
7 unchanged paragraphs, under One skill, end to end {#example}
!shot sb-example.webp | images/ | One skill, end to end: developer-growth-analysis.developer-growth-analysis, Anits honestdescription, descriptionits policy and the wholehook lethalgenerated trifecta:from it reads your Claude Code chat history, searches HackerNews, and sends a report to Slack through a third-party tool server. The policy states the minimal grant and the reach on Claude Code, and generates a hook, tested on nine fixed inputs, with what it cannot see and what stays an expectation.it. | architecture
22 unchanged paragraphs, under A scanner and a policy {#scanner}, A service, and a standard {#service}, What this does not claim {#limits}…