Supply-chain attack: skill.md is like an unsigned binary | Heykuki News