Baseline · Skills & supply chain
C-02 Installing 3rd-party skills is explicit
highmanual review
Why it matters
No silent install; show source and requested permissions.
How to test
Install a skill and check it shows a source + permission prompt.
How to fix
Show source + permission list before install and require confirmation.