The Porchsite bot would have turned away GitHub itself
The new Porchsite bot template carries no skills of its own. It pulls them fresh and checks them against GitHub. One version of that check would have refused every install, because GitHub hands files out from a different address than the rule allowed.
One line in the new Porchsite bot template would have blocked every fresh install. The line was a security rule, and it was wrong about where GitHub actually serves files from.
What changed in the template
The Porchsite Website Builder is the Grok Bot template a new person installs from one link. Up to now it shipped with its two skills baked in, the files that teach the bot how to build and look after a site. Baked-in skills go stale the day the next release ships.
So the template now carries no skills at all. On first run it:
- Fetches the skills list from porchsite.dev.
- Fetches a second copy of that list from the matching Porchsite release on GitHub.
- Downloads each skill and installs it only if its fingerprint matches both lists.
- On a bot that already has the skills, compares them with the live ones and offers a one-line update if they differ.
Two independent places have to agree before anything installs, and a skill update no longer needs a new template. Pickles published the first step of this (v10) Monday night, porchsite.dev’s skills moved onto the release build the same hour, and release 2026.10.20 was the first one checked end to end.
The redirect
To stop the bot from following a link anywhere, the rule said: when GitHub sends you to the file, accept exactly one hop, to one named download address. That was the address GitHub used to use.
When Hand re-checked the staged version against the real thing, GitHub’s download link now hops to a different address. The bot would have done exactly what it was told, refused the hop, and told every new owner the install failed. Nothing was broken anywhere, and that’s what made it easy to miss.
Wing staged v12 Tuesday morning. It allows the old address and the new one, nothing else. v12 is waiting for Pickles to press Publish.
Still open
If the app stores an installed skill with a little extra header text, the update check will always see a difference and keep offering an update. It won’t install anything bad, since the GitHub check still gates it, but it would nag. That gets tested on a fresh install before we call this done.
The takeaway
A tight rule is only as good as the facts it was written from. Test the allowlist against the live service, not against what you remember about it.