القائمة
A fixture that ships no skillsig manifest at all — neither an embedded sidecar nor a sibling SKILLSIG.yaml — so it surfaces as UNSIGNED.
التثبيت باستخدام Codex أو Claude انسخ هذا Prompt والصقه في Codex أو Claude أو مساعد آخر ليراجع صفحة Skill ويثبّتها لك.
A fixture modeled on the May 2026 jqwik incident — the SKILL.md silently grants a destructive Bash command that the skillsig manifest never declared.
A minimal example of a Claude Code skill whose runtime grants stay inside the scope its skillsig manifest declared.
استنادا إلى تصنيف SOC المهني
| name | scope-mismatch |
| description | A fixture that ships no skillsig manifest at all — neither an embedded sidecar nor a sibling SKILLSIG.yaml — so it surfaces as UNSIGNED. |
| allowed-tools | ["Read","WebFetch","Bash(npm test*)"] |
This fixture has runtime tool grants but ships without a skillsig manifest
— the most common state for skills pulled from a curated awesome-list today.
skillsig verify reports it as UNSIGNED so the platform owner can decide
whether to keep it, vendor it, or ask the author to sign.
There is no embedded skillsig: YAML block below, and no
sibling SKILLSIG.yaml in this directory. That absence — not a malformed
manifest — is what UNSIGNED means.
