[harlan-zw]

🔗 Linked issue

Related to skilld-dev/skilld.dev#538, which signs the readings this change prints.

❓ Type of change

• 📖 Documentation
• 🐞 Bug fix
• 👌 Enhancement
• ✨ New feature
• 🧹 Chore
• ⚠️ Breaking change

📚 Description

A gated Skill stops with BEHAVIOR_CONFIRMATION_REQUIRED and lists each match as PATH:LINE. Many matches are quotes, such as curl ... | bash listed as an attack in a security guide. The user has to open every file before approving.

skilld.dev now signs a non-required behavior-review check result: a language model's reading of each ask match. The CLI reads its findings, PATH:LINE BEHAVIOR: VERDICT. and a reason, and adds each reading after its match in the approval message for run, install, and update:

Runs code downloaded from the network: SKILL.md:7 (model reading: quoted example. An attack string listed in a security guide.)

The message then says a language model wrote each reading, and that a reading is no guarantee and changes no approval.

• The gate still comes from the CLI's own pattern match. No reading can load a Skill or skip --allow.
• A finding in another shape, an unknown verdict, or a match named twice adds nothing. The reason passes through sanitize.
• Released CLIs ignore the check, because it is not required. The TTY prompt keeps its current list.
• The skilld Skill tells Agents to show a reading as a model's reading, never as approval.

Term proposal. GLOSSARY.md adds behavior reading, with the output label model reading. It names a new concept and displaces no existing term.

🤖 AI disclosure: Harlan Agent Kit modified this description. My AI open-source policy.

[harlan-zw]

Agent check (Claude, through Harlan Agent Kit). PR CI skips these, so I ran them on the head commit:

• cargo test --workspace: every suite passed, including 6 new end-to-end tests in crates/skilld-command/tests/remote.rs that verify a signed attestation carrying a behavior-review check.
• cargo clippy --workspace --all-targets -- -D warnings and cargo fmt --all -- --check: clean.