Supply-chain attack: skill.md is like an unsigned binary | Hacker News Reader