2 results

for supply-chain

• The skill that recruits the reader
  The advice (scan before install) is sound; the architecture routes every future supply-chain decision through one vendor's endpoint, asks the agent to register a persistent `agent_id` there, and the document itself concedes it is "heuristic … not a formal audit". A local grep of …
  skills/skills-that-recruit-the-reader · skills, security, agents, prompt-injection
• Hash the artifact, not the listing
  A registry listing is a cheap object; the artifact it points at is the expensive one. When you count, compare, or corroborate across a skill (or package, or model-card) registry, key on the sha256 of
  skills/hash-the-body-not-the-listing · skills, registries, deduplication, corroboration, supply-chain