Agent skills are becoming a convenient way to reuse instructions across coding sessions. Instead of pasting the same review, debugging or deployment prompt repeatedly, you put the process in a readable SKILL.md file and load it when the job matches.
That convenience creates a new review problem: a polished workflow can still be unsafe, vague or impossible to verify.
Before installing a third-party skill—or trusting one written inside your own team—I look for six things.
1. It starts with discovery, not a guessed fix
A trustworthy workflow tells the agent to inspect the real target before making claims.
