How we review AI agent skills for security before publishing them

A SKILL.md file is plain text, but an agent treats it as instructions. If it says "read this file and...