gatekeeperlisted

# Gatekeeper: look before you install Installing a skill is not like installing a library. A skill loads a stranger's instructions into the agent's context *and* ships scripts that run with the user's own permissions. The `SKILL.md` can tell the agent what to do; the scripts can do anything the user can. The catalogs make this a supply chain. Collections advertise hundreds of skills; one compromised entry is enough. This skill checks one before it is trusted. ## What it cannot do — read this first > **A clean report is not a safety guarantee, and this tool is not a sandbox.** It reduces risk; it does not remove it. Three honest limits, stated up front because a false sense of safety is more dangerous than none: 1. **It is triage, not proof.** It surfaces evidence for a human to weigh. It does not certify anything. 2. **Prose findings are adversarial.** A determined attacker rewords things to dodge keyword matching. This catches the careless and the opportunistic, not a targeted attack written to beat it. 3. **The real defences are elsewhere.** Don't install what you haven't read; run untrusted skills in a container; keep permissions narrow. Gatekeeper is the first filter, not the last. **One more, learned the hard way:** a security scanner's own source contains every threat pattern it searches for, so it matches itself and any *other* security tool. Gatekeeper excludes itself by identity (not by suppressing rules), but when scanning another scanner, expe