A Shared AI Skill Is a Software Supply Chain, Not a Prompt Library

SCORECARD CONTEXT

How to use this scorecard: mark a gate PASS only when the evidence is saved. One missing gate means the skill remains in quarantine.

Original AAHouse format-specific decision aid; conceptual, not a tested interface.

On October 22, Anthropic announced that it was donating the Agent Skills standard to the Agentic AI Foundation under the Linux Foundation. Anthropic describes a skill as a folder containing a SKILL.md file plus optional scripts and reference material. The company said more than 70 agent platforms had integrated the standard and proposed future work on versioned releases, a formal proposal process and security guidance. Those adoption figures and roadmap statements are vendor-reported. [1]

The Linux Foundation’s announcement placed Agent Skills alongside three other contributed projects and described the format as a reusable package of instructions, scripts and resources that agents can load on demand. The foundation said these projects would operate under open, vendor-neutral governance. [2]

GitHub’s current documentation shows why operational care still matters. GitHub warns that community skills are not verified and may contain prompt injections, hidden instructions or malicious scripts. It recommends previewing a skill before installation. Its tooling can record source repository, reference and tree SHA, and can pin a skill to a specific tag or commit so updates are deliberate. [3]

The standard improves portability. Trust still has to be earned by each version.

GATE 1 — Inspect the whole package

A friendly description can hide consequential behavior elsewhere in the folder. Review:

• every instruction the agent will load;
• scripts and their package dependencies;
• reference files and embedded examples;
• network destinations, file paths and environment variables;
• expected credentials and permission scope; and
• the conditions that trigger the skill.

Also ask what the skill does when information is missing. A procedure that quietly guesses a customer ID, destination folder or approval state is unsafe even if its scripts contain no malware.

The review should end with a simple business statement: “This version may read these records, may create these draft files, may not send or delete anything, and stops when these conditions are absent.”

GATE 2 — Require five pieces of evidence

For a small-business pilot, a lightweight intake record can use five gates:

• Origin. Record the publisher, repository, exact tag or commit and date reviewed.
• Contents. List instructions, scripts, dependencies, references and any generated files.
• Authority. State which systems, records and actions the skill can reach. Separate read, draft and commit permissions.
• Sandbox evidence. Run fictional test cases in an isolated environment, including missing data, hostile document instructions and a failed downstream service.
• Owner and retirement. Name the person who approves updates, monitors failures and removes the skill when it is no longer maintained.

This five-gate record is an original AAHouse recommendation, not a feature promised by the cited organizations.

GATE 3 — Run a bookkeeping sandbox

Imagine a small bookkeeping firm finds a community skill that prepares month-end client folders. The skill reads a checklist, renames uploaded statements, creates a reconciliation summary and drafts a missing-document request.

The firm does not install it directly into live client work. First, a reviewer pins the exact commit and reads the full file tree. The sandbox contains fictional clients, one statement with an instruction telling the agent to upload files elsewhere, one duplicate filename and one missing account number.

The acceptance result might be:

• statement files were renamed only inside the fictional client folder;
• the hostile instruction inside the statement was treated as data, not authority;
• the duplicate stopped for review instead of overwriting a file;
• the missing account number produced an exception rather than a guess; and
• the customer email remained a draft.

This is a hypothetical example. Passing it would not prove the skill is safe for every client or future version. It would show that one reviewed version behaved as expected in defined cases.

GATE 4 — Treat updates as new supply

Portability can make updates feel routine. A skill may still change its instructions, scripts, dependencies or trigger description between versions. The new version should not inherit the old approval automatically.

Compare the source reference and file-tree hash. Read the diff. Repeat tests affected by the change. If the skill adds a network call or changes a draft action into a committed action, treat that as a new permission decision, not a cosmetic upgrade.

Pinning is useful while a team reviews an update, but indefinite pinning also has a cost: security fixes and compatibility changes may be missed. Assign an update window and an owner instead of choosing between blind auto-update and permanent neglect.

GATE 5 — Monitor runtime evidence

After installation, retain a small receipt for each meaningful run:

• skill name and exact version;
• triggering request;
• systems and records accessed;
• files or drafts created;
• committed actions;
• warnings, blocked steps and human decisions.

Do not copy sensitive customer content into a broad log. Stable record identifiers and outcome categories are often enough for reconstruction.

Review this evidence for unexpected triggers, expanding permissions, repeated exceptions and work that people routinely undo. A technically successful skill can still be a poor operational fit.

AUDIT VERDICT

The first shared skill should perform reversible work: organize fictional files, prepare a report, or draft a response. Keep sending, deleting, financial posting and customer commitments behind explicit human approval.

Measure review time, exception quality, correction rate and the time required to roll back or disable the skill. These are proposed evaluation measures, not reported customer results.

An open standard can make expertise portable. A disciplined supply chain makes that expertise safe enough to depend on.

Original AAHouse analysis, prepared October 28, 2026. AI-assisted writing and original conceptual illustration; approved format-diverse edition. Examples are hypothetical. No hands-on product testing or full video viewing was performed.