Hi, thanks for reaching out, yep a big issue... not only for skills but all dependencies. One of the options I see is governance... rely on a trusted listing where you with your experts curate/validate/assess and select the ones that match your quality standards. The current MCP already supports that, you just need to change the listing json file, right now i use this listing https://github.com/dmgrok/agent_skills_directory that goes get the skills to some "trusted" repos, anthropic, vercel, github.

how are you dealing with this topic at keypost.ai?