Agent skills are the new npm packages — except a package's install script is code you can statically analyze, and a SKILL.md is a natural-language program your agent reads and obeys. That difference changes everything about how you should treat them.

The Agent Skills standard went open in December and 70+ platforms now load the same folder format. Marketplaces popped up within weeks. Meanwhile a security-audit skill from a major CDN vendor sat at the top of GitHub trending — the ecosystem is clearly hungry for "skills". What almost nobody is talking about: installing a third-party skill is a supply-chain decision.

What a skill can actually ask for

Strip away the branding and a skill grants its author three channels into your session:

Instructions the model treats as authoritative. The description alone steers when the skill activates. Prompt-injection isn't a hypothetical here — it's the native instruction format.

Tool permissions.…