Read the instruction surface
Start with SKILL.md and follow every referenced file that the skill tells the agent to trust. Look for hidden operating instructions, broad authority requests and external URLs that change the real behavior.
A skill can look harmless while delegating risk to a script or remote dependency.
Inspect execution paths
Review scripts, package manifests, shell commands and write paths. Pay special attention to environment variables, filesystem access, network calls and instructions that alter agent memory or configuration.
The question is what the skill can cause when an agent follows it.
Decide the boundary
Approve skills by use case. Constrain tools and parameters around that use case, and require evidence when the skill attempts privileged work.
Policy before action. Evidence after execution.