Tessl has published the talk every team installing agent skills should hear. In Agent skills are supply chain components, a security researcher writes up an AI Native DevCon London session titled “Your AI Agent Installed Malware Because a SKILL.md Told It To.” The opening was a show of hands: who had added a skill to an agent recently, and then, who had actually read the markdown. “That second question is where the talk really began.” The argument is that a skill “can look like documentation,” but once an agent trusts it, it “can influence what the agent reads, what it changes, which tools it calls, and which parts of the workspace it treats as trusted context.” So skills “deserve the same kind of suspicion, review, provenance, scanning, and update discipline that we eventually learned to apply to package ecosystems.”
The one figure is reported with appropriate restraint: a scan of roughly 4,000 skills from a public ecosystem found “suspicious downloads, credential-related risks, malware-like behavior, misuse, and security vulnerabilities,” and “the exact percentage matters less than the direction of travel.” The sharpest line is five words: “In an agent workflow, markdown can be behavior.” The post takes apart “read the skill first” on three counts: depth, because a skill includes supporting files, scripts and assets a reviewer may skip; time, because updates arrive after the review; and trust, because accepting a workspace folder extends trust to whatever skill sits in it. The risk model is the combination of private context, untrusted content and external communication. “Any two of those can be risky. All three together are where the failure mode becomes serious.” And human approval weakens under repetition, from vulnerability fatigue into “acceptance fatigue.”
The catalog holds Tessl as a skills registry with a substantial API. The tessl.io provider page lists API pages including the tessl.io Context API, the tessl.io Agent Logs API and the tessl.io Evals API, with access governed through the tessl.io API Keys API. On the Agent Readiness score, the MCP server, agent skills, idempotency, reversibility and error semantics are lit.
The Kin Score is 56.3, strong band, with developer ergonomics at 73.2 and discoverability at 71.7 against contract governance at 4.5. The Agent Readiness score is 38.2, agent-ready. The unlit dimensions are worth reading against the talk. Delegated identity and consent identity are unlit, and they are the API-level answer to the trust problem the post describes: a way for an agent to act under a scoped, attributable grant rather than the full trust of the folder it was opened in. Tessl has named the supply chain risk precisely. A registry that wants to be part of the answer will need its own contract to carry provenance and scope as well as content.