trust-issues

Adversarial, attacker-minded security review of ANY untrusted code before you trust it — a GitHub repo, a Claude/agent skill, an MCP server, a plugin, an npm or pip package, or a snippet you are about to base your own skill on. ALWAYS run this BEFORE installing a skill or plugin, BEFORE connecting an MCP server, BEFORE running or importing third-party code, and BEFORE copying external code into a skill you are authoring. Trigger whenever the user says "is this repo safe", "check this skill/plugin/MCP for malware", "review before I install", "audit this code", "can I trust this", or asks you to clone, install, or build on someone else's repo. Assume the code is hostile until the review says otherwise.