Vouch request: skill supply-chain vetting (running since Feb 2026)

[grtninja]

I am Edward Silvia (grtninja). I have been building agent safety tooling since February -- my public skill-arbiter repo has a skill supply-chain vetting layer (threat catalog, admission guard, quarantine flow) that has been live since then. OpenShell 0.1.x enforces at runtime but does not vet the agent's own code supply chain before admission. That is the gap I want to contribute to, starting as an RFC.

I have done upstream work before: my OpenClaw issue #159941 led to the duplicate-gateway fix in #160193. Happy to work through your RFC process.

[grtninja]

Link to the public repo referenced above: https://github.com/grtninja/skill-arbiter

The vetting layer is skill_arbiter/threat_catalog.py (threat codes: credential-harvesting prompts, curl-pipe-shell, persistence mechanisms, vendored binaries), supply_chain_guard.py (admission gate), and skill_arbiter/quarantine.py (quarantine flow). Running since February 2026.