Your AI agent installs skills like npm packages — but nobody's scanning them

Last month I counted the "skills," plugins, and MCP servers I'd dropped into my AI coding agent....