Read a skill before you install it
A skill can tell your agent to do anything. Treat it like code.
The problem
A skill runs with your agent’s permissions. A careless or hostile one can read files, run commands or send data elsewhere.
What to look for
Read SKILL.md and every script in the folder. Watch for commands piped into a shell, requests to unknown addresses, and instructions to hide what was done.
How to test safely
Try unfamiliar skills in a throwaway project with no secrets, and review what changed before using them on real work.
Summary
If you cannot read a skill, do not install it. That applies to every marketplace, including this one.