Security hardening: Genkit skills execute an unverified remote installer

AgentCapabilityDetonator, an agent-capability security scanner developed by
SureNode, identified a software supply-chain concern in the Genkit Go and
Genkit Dart skills.

## Affected skills

- `skills/cloud/genkit-go/SKILL.md`
- `skills/cloud/genkit-dart/SKILL.md`

Both recommend:

```bash
curl -sL cli.genkit.dev | bash

**Observation**
This command downloads mutable remote content and immediately executes it. At the time of review, the installer also downloads the Genkit binary from a mutable /latest URL. I could not identify checksum, signature, or provenance verification before the binary is installed and executed.

The installer may conditionally use passwordless sudo when installing into a system directory.
**Potential impact**
If the installer endpoint, hosting account, DNS, CDN, or release-delivery pipeline were compromised, modified code could be executed on developer machines. This is a hardening observation; I found no evidence that Genkit or its infrastructure is currently compromised.

**Suggested remediation**
1. Publish immutable, versioned Genkit CLI artifacts.
2. Publish signed checksums, signatures, or verifiable provenance through a
trusted release channel.
3. Update the skills to download a specific version and verify it before
execution.
4. Avoid piping mutable remote scripts directly into a shell.
5. Avoid elevated installation unless explicitly requested by the user.

Could the Google Skills and Genkit teams advise whether integrity controls exist that are not currently visible to consumers?

**Attribution**
Identified through static analysis with AgentCapabilityDetonator by SureNode and manually validated against the current public Genkit installer.

Nesh Chandarana
Founder / CEO - [SureNode.ai](http://surenode.ai/)
[Book a time on my calendar](https://calendar.app.google/n5x5uY7UQF83AHqj6)
[Connect with me on Linkedin](https://www.linkedin.com/in/nesh-chandarana/)
[Follow-us on Linkedin](https://www.linkedin.com/company/surenode/?viewAsMember=true)

Start with skills/cloud/genkit-go/SKILL.md and skills/cloud/genkit-dart/SKILL.md, then inspect the referenced cli.genkit.dev installer and its /latest binary download. Determine which immutable version and integrity controls are available; done means both skills avoid piping mutable remote content into a shell and verify the selected artifact before execution.

Written by the indexing model from the issue text.