Skip to content
T threat.cafe

Tag

#code-review

1 post

  1. · Tobias Lindqvist-Rao · Agent artifact supply chain · on threat.cafe

    Markdown is executable now: why SKILL.md instructions slip past code scanners, and what a skill review must actually read

    A skill's behaviour lives in its prose, its frontmatter and its load-time commands, not only its scripts. Code scanners read the scripts. This one-page rubric reviews the rest as code.