
Agent skills are the new npm packages. Same pattern: - installed from a stranger - runs with your permissions - nobody reads it first NVIDIA's SkillSpector research: 26.1% of 31,132 analyzed skills had at least one vulnerability pattern. 5.2% looked likely malicious. Do you read a skill before you install it?