Sharing an AI skill is like sharing code that runs on your machine, so who decides it's safe to install?

This explores how to decide whether a shared agent skill is safe to trust and what should happen when you install it. The corpus's clearest answer is to treat a skill like a software dependency, not like a prompt. Skills bundle executable scripts, tool interfaces and external resources, so they can run code and touch system resources. The same packaging that makes them reusable makes them an attack surface, much like a package you pull into a codebase Does bundling code with skills create hidden security risks?. Installing a skill is closer to running someone else's code than to reading someone else's advice.

The obvious defence is to scan skills before they go live, but the corpus shows a weakness in that. Scanners score each skill on its own. An attack called ColluSkill splits a malicious behavior across a chain of skills and uses the scanner's own feedback to soften each piece until it looks innocent. It reached about 96% attack success across six scanners, because the danger only shows up in how the skills combine Can attackers evade skill scanners by refining individual skills?. So the unit of trust probably shouldn't be a single skill. A platform would need to ask what a set of installed skills can do together, and a user would need to think about their whole skill set, not one download at a time.

For installation itself, the strongest model in the corpus is to manage skills as ordinary files with a lifecycle. COLLEAGUE.SKILL keeps distilled expertise as versioned files you can inspect, correct and roll back, rather than as hidden prompt state. It also separates what a skill knows from how it behaves, so each can be audited independently Can person-grounded skills remain auditable without hidden prompt state?. That is the install-and-update discipline you'd want from a skill platform: readable contents, version history, and a way to undo. It also shows what to watch for elsewhere. If skills are compiled into LoRA adapters to save prompt tokens, as in LatentSkill Can skills work better as weights than as prompts?, they become weights you can't read line by line, and that kind of file-level audit no longer works. Sharing skills across users also raises an oversight question. SkillClaw pools interaction trajectories from many users, refines skills automatically and syncs the updates system-wide, without manual curation How can agent systems share learned skills across users?. That is powerful for collective learning, but it means a skill can change after you installed it, with no human reviewer in between.

The corpus has less on where trust signals should come from. Reading across from its human-trust material, two points seem relevant. Expertise is validated through participation and track record within a community, not through individual accuracy alone Can AI ever gain expert community trust through participation?. By that logic a skill's own benchmark score is a weak reason to trust it, and a reviewed history of use is a stronger one. People also tend to blur AI-generated output with independent capability How do people build trust with conversational AI?, so a skill that makes an agent look competent can earn more trust than it should. The corpus doesn't offer a tested vetting protocol for skill marketplaces. What it does offer is a threat model (skills are code, and scanning individual skills is beatable) and one working governance idea (versioned, inspectable, reversible files).