From the latest blog post
How to git clone and review an AI skill, and why you must sever its phone-home channel even when it looks completely benign.