skillsig

A fixture modeled on the May 2026 jqwik incident — the SKILL.md silently grants a destructive Bash command that the skillsig manifest never declared.

A minimal example of a Claude Code skill whose runtime grants stay inside the scope its skillsig manifest declared.

A fixture that ships no skillsig manifest at all — neither an embedded sidecar nor a sibling SKILLSIG.yaml — so it surfaces as UNSIGNED.