Third-party skills get checked first
A skill from someone else's repo is prompt code. tackroom doctor scans it for risky patterns and checks it against the agentskills.io spec. It also flags npm and PyPI packages your config pulls in if they are less than three days old.
$ tackroom doctor package age .............. pass (1 references at least 3 days old) external skills .......... pass (1 sources valid) external skill lock ...... pass (1 sources pinned and in sync) external skill audit ..... pass (1 skills scanned, no risky patterns)