.github/workflows/sync-skills.yml references "actions/checkout@v4" instead of a full 40-character commit SHA.
Pin third-party GitHub Actions and reusable workflows to a full commit SHA.
ai.extend/extend · v1.0.0 · MCP server
Turn documents into structured data: parse, extract, classify, split, and fill PDF forms.
Guard checks the skills and MCP servers a plugin adds on your machine and asks you before a risky action runs. The scores above are free, and no plan changes them.
From the plugin's manifest and HOL's scan. Anything the plugin does not declare is shown as not declared.
HOL cannot see every install. These are separate signals from different sources, so they are not added together. Counts under each floor show as <N.