Skill directory founder: agent trust problem is the install, not the search
toohightottype · reddit · 2026-10-18
The founder of Skill Harbor, an open directory of AI agent skills/connectors/tools, lays out the trust problem in agent ecosystems: the real risk isn't discovery but installation—you're letting a stranger instruct your agent on your machine.
Their deliberately modest approach: no code audits and no "safe" badges. Instead, they pin installs to the exact commit tested in their sandbox rather than whatever the repo points to; scan install prompts and plainly label whether a build runs commands, uses the network, installs packages, writes files, or uses API keys; list all hosts contacted during testing; and recheck download fingerprints nightly, flagging listings until a human reviews any change.
They avoid gatekeeping: builds that look helpful get listed with clear labels so users decide for themselves. The post ends with an invitation to submit builds and a question: what actually stops you from installing others' skills—the code, the prompt, or not knowing what changed since testing?
More from coding & agent
- Same model, three harnesses: DeepSeek harness scores 42.5 vs Claude Code 39.1 on Bug Hunt Bench — PawelHuryn · 2026-10-19
- Proof Before Reuse: 0/30 poison exposure vs naive agent memory — maa____z · 2026-10-19
- Pi harness nearly matches DeepSeek's own at 42.2 vs 42.5 on Bug Hunt Bench, at half the cost — PawelHuryn · 2026-10-19
- Dev ships netplay in unplanned game after 3-4 days of grilling frontier models on the spec — banteg · 2026-10-19
- kimo: open-source MCP video editor your coding agent can drive — LieTop7965 · 2026-10-19
- DeepLearning.AI launches browser-based agentic coding lab in free on-device memory course — DeepLearningAI · 2026-10-19