No, skills are telling the model how to run a script to do something interesting. If you look at the skillshub the skills you download can include python scripts, bash scripts... i didn't look too much further after downloading a skill to get the gist of what they had done to wire everything up, but this is definitely not taking security into consideration

You are confused because the security flaws are so obvious it seems crazy that people would do this. It seems that many of us are experiencing the same perplexity when reading news about this.

"there are security flaws in the 'tell an llm with god perms to do arbitrary things hub'"

Is such an obvious statement it loses all relevant meaning to a conversation. It's a core axiom that no one needs stated.