Agent skills are a supply chain risk. Scan them like it matters.

Agent skills are the new npm packages — except a package's install script is code you can statically...