TrustSkills

This skill is a lightweight URL/org allowlist checker — it only looks at the source URL and matches it to a small set of trusted roots. It does NOT do code or signature verification, ownership proof, or malware analysis. It's safe to invoke (no creds, no install), but do not rely on it alone for high-risk installations: manually verify the repository owner, check upstream vendor docs, inspect code or release artifacts, look for signed releases or SBOMs, and prefer vendor-owned GitHub orgs or official marketplace entries when possible. Note the compact allowlist contains narrow exceptions (e.g., a specific ClawHub publisher); treat such rules as policy shortcuts rather than technical guarantees and follow up with manual checks when the install would affect sensitive systems.