The security model of agent skills: what you are actually installing

A skill is not data — it is instructions that steer your agent inside your repository, with your credentials. One realistic attack chain traced end to end, why the permission system rather than the skill file is the trust boundary, why commit-pinning fails outright for most repos through the Skills…