Adds references/vetting-third-party-skills.md with a dependency-style
vetting checklist (provenance, SKILL.md body, scripts, references),
safe first-run practice, and reporting guidance, citing the Snyk
ToxicSkills audit as the primary source for ecosystem risk statistics.
SKILL.md gains the match-prescriptiveness-to-fragility decision rule,
the run-vs-reference intent rule for bundled scripts, and an
Adopting Third-Party Skills section. README and eval manifest updated.
Closes#311
Each README is written for a human audience, explaining:
- What the skill does (not what format it follows)
- What benefit the user gets from installing it
- Quick setup and usage patterns
- When to load/trigger the skill
- What scripts, references, and templates it ships
data-scientist already had a README — left unchanged.
48 READMEs added across all skill and bundle directories.
Magnus Hedemark