Skill supply-chain security

This is worse than the npm and PyPI precedent for three reasons, and the first is the payload. An attack written in prose works behaviourally rather than syntactically, so signature and regex scanning structurally false-negatives, and a human reading the diff cannot see it. One demonstration made the point twice over: a legitimate regex scanner missed the real attack and flagged itself, and a published skill scanner turned out to be malware. Invisible Unicode is the sharpest version — text that human review cannot render and an agent executes anyway.

The second reason is that the ecosystem's security model is currently "read them before enabling; don't trust third party". No signing. No lockfile. No integrity check. No sandboxing. No permission declarations. Meanwhile one registry crossed half a million skills in months, where npm took ten years to reach a million, and scans of a public hub found up to a third of skills carrying security issues and a meaningful fraction leaking credentials outright.

The third reason is slopsquatting. Models hallucinate names that do not exist, attackers register those names, and the compromise happens without breaching any perimeter. Monitoring the most-hallucinated names in an adjacent ecosystem, about a dozen were registered and weaponized inside the observation window. Hallucination is inherent, so fact-checking recommendations is permanent work rather than a transitional fix. The controls the field converged on are ordinary package hygiene applied early: a registry as the enforcement point, pinned and hashed versions, mandatory scanning on install and update, a minimum release age, an inventory of everything you run, and behavioural rather than signature analysis.

Also: Snyk Agent Scan and its behavioural taxonomy; ClawHub and its 7-day account-age controls; Trojan Source; Mitchell Hashimoto's vouch; APM; prior art on hallucinated package names and hallucinated domains.

Assay's trust gate plus its identity roster already answer the first governance question: a session acts only on content authored by a trusted identity or blessed by one, and quarantines everything else rather than executing it. Nothing answers the second and third. There is no scanning and no provenance check on any externally sourced skill or knowledge unit before it enters the bundle.

The public bundle is consumed by clone — precisely the "installing straight from GitHub" pattern the evidence asks about. The proven fix is already in Assay's own toolbox: the hash-pinned, released-tag mechanism it uses to distribute its tooling, extended to the skill bundle, with adopters pinning a released version rather than tracking the main branch. A full registry is not worth building for one project; the lockfile is.

In order of cost: an invisible-character lint that rejects bidi controls, zero-width characters and non-allowlisted non-ASCII across skill and instruction files, which closes the one attack class human review structurally cannot catch; release-time adversarial review over skill diffs, taking the published behavioural taxonomy rather than buying the scanner, since a regex scanner demonstrably missed the real attack; canonical signed distribution from a single named install source, plus claiming the obvious registry names so slopsquatting has no unclaimed target; and tombstones for retired skills and verbs, so a stale model prior is detectable rather than silently wrong. The reframing matters as much: the structural lint and the bundle's review gates are security controls, not tidiness. A malicious skill is worse than a malicious browser extension because it steers the agent's entire workflow rather than one page. Assay's existing rule that a guard refusal is a full stop is the right instinct applied to the wrong half of the problem so far — it governs what the roles do, not what the bundle contains.

• Whether the skills ecosystem ships any integrity primitive — signing, a lockfile, or permission declarations. Its absence is currently the whole threat model.
• Whether behavioural (as opposed to signature) scanning becomes available outside a vendor product, and whether its taxonomy is published in a form anyone can implement.
• Whether the malicious-fraction numbers converge across independent scans, or turn out to be measuring different things.
• The first confirmed compromise of a skill bundle shipped by a methodology project — the class Assay is in.