Checked skills

A Checked skill was pulled at a named commit and statically scanned: the manifest parses, nothing reads credential stores, nothing contacts a host outside a published allowlist, nothing decodes and runs an encoded payload, and there is no curl-pipe-to-shell installer. Each skill's page lists its individual check results and the lines behind them. It is a machine reading the code as published, not a judgement that the skill is any good.