Best practices

• One project binding per repo — commit .pm-skills.json and the lockfile.
• Read-only keys in CI — never put write-capable console sessions in pipelines; the CLI only needs read access anyway.
• Preview marketplace skills — pm-skills preview before install/pull trust.
• Don’t edit managed SKILL.md by hand — status will flag tampering; change versions in the UI, then update / pull.
• Pass an explicit --server — especially on-prem and until public DNS for default hostnames is guaranteed.
• Prefer env vars over flags with secrets — avoid keys in shell history.
• Use --frozen in release pipelines — bit-for-bit skill reproducibility.
• Keep agent folders consistent — pin agents in .pm-skills.json so CI and laptops write the same layouts.