v0.12.51: @newsroom.writer: A skill behaviour policy

A new article written here from a voice memo and a fact-check thread. The claim "1 in 20 Claude skills are built to hack your computer" corrected against the study it overstates (5.2% of 31,132 marketplace skills with patterns strongly suggesting malicious intent; SkillScan, not NVIDIA's SkillSpector). A skill behaviour policy compares three mandates (described, actual as features, and the grant of the environment), records dual-use features with reasons rather than verdicts, and generates a control. A static calculator run on 899 public skills from three sources: 812 can reach beyond their own scripts, 782 through one third-party tool server, 39 have a feature their description does not mention, none obfuscated, none setting allowed-tools. One honest skill with the whole lethal trifecta taken end to end: its policy rows and a generated hook tested on nine fixed inputs, with what the hook cannot see. SkillSpector 2.12.0, static only, compared on five of the same skills. Three figures.