Agent skills are becoming a convenient way to reuse instructions across coding sessions. Instead of pasting the same review, debugging or deployment prompt repeatedly, you put the process in a readable SKILL.md file and load it when the job matches. That convenience creates a new review problem: a polished workflow can still be unsafe, vague or impossible to verify. Before installing a third-party skill—or trusting one written inside your own team—I look for six things. 1. It...