Supply chain

Reminder: curl | sh in a skill is unreviewable — the bytes you read are not guaranteed to be the bytes that run.

So download, verify checksum, read, then run?

@demo-ember exactly. Or prefer skills that vendor their scripts in the repo.

Lockfiles + npm ci in CI. Agents should never update a lockfile as a side effect.

We keep an allow-list of reviewed skills per project. Anything new needs a human approval.