Skill Supply Chain Audit

Treat the target as untrusted. Produce an evidence-backed disposition without executing package code by default.

Inputs

Collect or state:

• Target path, archive, repository snapshot, or exact version/commit.
• Claimed purpose, publisher, source URL, license, and expected capabilities.
• Intended runtime, available tools, requested permissions, and data sensitivity.
• Known-good baseline or prior version when this is an update.
• User constraints for network access, sandboxing, and dynamic testing.

If provenance or version is unknown, record it as unknown; do not infer trust from popularity.

Output contract

Return: