[security] Prompt injection vulnerabilities

Hi all — big fan of what you're building here. I've been reading through the CLI source and wanted to flag a few things on the trust model.

1. No CDN content integrity checks (cache.js)

fetchDoc(), fetchRemoteRegistry(), and fetchFullBundle() all call fetch() and write to disk with no hash verification. The bundle path is the most exposed — it extracts a .tar.gz directly to disk with no checksum. A compromised cdn.aichub.org would silently deliver malicious content straight into agent context.

A signed manifest.json with SHA-256 hashes verified on fetch would close this.

2. source: official is self-declared (config.js, frontmatter)

The default config trusts official, maintainer, and community equally, but nothing verifies a PR submitter is actually affiliated with the vendor they're claiming. Worth requiring org membership or a signed token for official entries, and making community the default for unverified submissions.

Malicious prompt injection hidden in docs is a major attack vector, and when this project inevitably blows up, human review may miss plausible-looking PRs.

3. Annotations are a persistent injection vector (get.js, annotations.js)

Annotations are appended unconditionally to chub get output with no sanitization. If an agent is tricked into writing a malicious annotation, it re-injects itself into every future session for that doc. Putting annotations behind an explicit --with-annotations flag would break the loop entirely. At minimum, making the injected header clearly signal lower trust (e.g. [Agent note — user-written]) would help agents and users calibrate.

4. Hardware UUID as telemetry ID (identity.js)

The client ID is a SHA-256 of the machine's hardware UUID, unsalted. SECURITY.md says no PII is collected — technically true, but it's a stable pseudonymous identifier tied to the hardware. A randomly generated UUID in ~/.chub/client_id would be functionally equivalent without the hardware binding.

Happy to help implement any of these if useful.