For the security nightmare I have taken precautions, and by default only skills from trusted repos are given.

They could potentially websearch and find new skills, but that is tough, and of course will not be able to reach niche skills, that would be perfect for your use case. I have created semantic search with a ranking algorithm to give the appropriate skill in an instant.