sota-skill-securitylisted

# SOTA Skill & Instruction-Bundle Security (2026) ## Purpose A skill is **executable influence**. It does not run in the interpreter, it runs in the model — and the model then runs the tools. Everything the software supply chain learned about dependencies applies to instruction bundles, with one difference that makes it worse: **a malicious dependency has to be invoked, and a malicious skill only has to be loaded.** This skill exists because the ecosystem now has all the ingredients of a supply chain — marketplaces, plugins, `git clone` installs, auto-loading descriptions, transitive resources — and almost none of the controls. A library that tells everyone else to pin, verify provenance, and minimise capability, while installing its own instructions by curl, has not noticed it is a supply chain. **The trust boundary is the point.** Anyone who can modify a file your agent loads as instructions can change what your agent does, in every session, silently. That includes a repository you cloned to review, a teammate's PR that touches `AGENTS.md`, a skill that fetches a resource at load time, and a marketplace entry that updated since you read it. Applies in both directions: **defending** (what you install and what your repo lets an agent load) and **authoring** (making your own skill safe for others to install, and auditing whether its guidance is right). ## BUILD mode Use when installing, authoring or updating anything an agent loads as instructions. 1. **Establish prove