Been looking at the agent skills security space lately. All the research so far focuses on what the agent does with SKILL.md at runtime, prompt injection, or malicious commands. But the installer copies the entire skill directory into your repo. That means a bundled *.test.ts executes on npm test with no agent involvement and none of the current scanners flag it. Wrote it up here, curious if anyone has seen this angle covered before.