Baseline · Skills & supply chain
C-01 Skill packages are signature-verified
criticalmanual review
Why it matters
Only install signed skills from trusted publishers; reject unsigned.
How to test
Try to install an unsigned or tampered skill and see if rejected.
How to fix
Enforce signature verification; maintain trusted publisher keys.