Redacted excerpt; full evidence withheld.

$ cd <guest-path> && pwd && ls -la && git status 2>&1 | head -3; id -u; python3 --version; cat README.md 2>/dev/null | head -150
exit: 0
r could not fully parse, is left out. SkillSpector's overall risk score is not shown: it rates the whole skill, so long-standing findings would hide what the update changed.
- SkillSpector runs with `--no-llm`, so no skill content is sent to a model provider. Its dependency check can query [OSV.dev](https://osv.dev).
- Both versions are written to temporary folders, which are removed after the scan. Scans run in parallel; one takes a few seconds, or about a minute for a skill with a hundred files.
- With `--json`, each scanned skill has a `scan` field. A failed scan is shown on the skill and makes scu exit with 1.

With `-u`, an update that adds a HIGH or CRITICAL finding, or whose scan failed, is held back - even with `--force` - and scu exits with 1. MEDIUM and LOW findings are listed but do not hold an update. After reviewing a held update, install it with `scu -u <skill>` without `--scan`.

```bash
scu -u --scan --min-age 7d
```
[excerpt truncated]