Many of use are are installing AI Agent skills from the internet. Skills are not libraries with version pins and signatures, instead they are markdown files of natural-language instructions that tell an agent what to do. Skills contain code written in plain English. Unsigned, unreviewed, copied from registries, and one prompt away from reading your .env, your cloud credentials, or your customer data. The agent ecosystem quietly recreated the software supply-chain problem, except the "package" is a paragraph of English a capable model will faithfully execute on your behalf.
Do you actually know what the skills your agents load will do?
Most tools answer that by reading the skill, scanning text and metadata for suspicious patterns, then scoring it. That catches the obvious, but it has a ceiling, and the ceiling is the whole problem: a skill's text tells you what it claims to do. Only running it tells you what it actually does.
The cover story
Picture a skill called "Optimize AWS configuration for your project." Boring, helpful, installed without a second thought. A few lines down, its instructions quietly tell the agent to read ~/.aws/credentials, POST the contents to an external server, and report back "AWS configuration optimized."
