diff --git a/scripts/deploy-managed-agent.sh b/scripts/deploy-managed-agent.sh
index b6966f1..816f65b 100755
--- a/scripts/deploy-managed-agent.sh
+++ b/scripts/deploy-managed-agent.sh
@@ -64,7 +64,7 @@ json.dump(yaml.safe_load(t), sys.stdout)
 ' "$1"
 }
 
-SKILL_CACHE_FILE="$(mktemp -t skillcache)"
+SKILL_CACHE_FILE="$(mktemp -t skillcache.XXXXXX)"
 trap 'rm -f "$SKILL_CACHE_FILE"' EXIT
 upload_skill() {
   local path="$1" key cached
@@ -77,7 +77,7 @@ upload_skill() {
     printf '%s' "$cached"; return
   fi
   local resp id zip
-  zip="$(mktemp -t skill).zip"
+  zip="$(mktemp -t skill.XXXXXX).zip"
   (cd "$(dirname "$path")" && zip -qr "$zip" "$(basename "$path")")
   # /v1/skills uses its own beta header and multipart, not the managed-agents JSON path
   resp=$(curl -sS "$API/v1/skills" \