Agent Skills are a 40,000-listing unvetted marketplace and scanners miss the malicious ones.

One marketplace hit 40,000+ listings within months of the format's late-2025 debut, almost entirely community-submitted with no vetting, and malicious skills routinely slip past the scanners built to catch them (Help Net Security). A skill is instructions plus scripts plus files loaded on demand, which makes it strictly more dangerous than a prompt and strictly harder to statically analyze than a package. Treat third-party skills like unpinned npm dependencies with shell access, because functionally that's what they are. We solved this in package management with lockfiles, signatures, and scanning. Skills have none of it.