Thinking about what manzanarama mentioned regarding checking skills into a repo, that's exactly how I look at it. To me, these skills are just specialized configuration. We've been versioning configuration for decades because it's critical to reproducibility and maintainability.

The "cognitive load" problem latand6 raised for reviewing every skill is real. That's where you integrate security and quality gates – treat these skills like any other software artifact. You wouldn't manually review every line of every dependency, so automate the validation here too.