Richard Terry-Lloyd
Three identical-looking skill packages drawn as white cards on a pale grid, each with the same label bars: the first carries a solid amber verification seal and a signature strip, the second is x-rayed open to reveal a dark tangle of embedded code with tendrils running out of its side, and the third has a broken seal and a ghosted duplicate of itself offset behind it. Below them a chain-of-custody rail runs solid amber from a maintainer node to a registry node, then turns dashed and uncertain on its way to the machine it installs on.
Back to blog

Who Maintains the Skills Your Team Installs?

·Richard Terry-Lloyd
AISecurityGovernanceOpen SourcePlatformEnterprise

I was in Salt Lake City last week seeing customers, and spent some time with Tanner Linsley and Jonathan Hislop from TanStack.

The three of us and Sarah Mandel ended up talking for a long time about models, security, and skills.

Why TanStack keeps coming up

TanStack is foundational to a huge number of the apps being built right now. And the models love it — ask an agent to build something serious in React and you will very often get TanStack back without having asked for it by name.

We just redeployed our own agent using tooling from their latest release. Jack Herrington on our team is deeply involved in the community.

Their sponsor list gives you a sense of how important the ecosystem has become: Lovable, Cloudflare, Vercel, CodeRabbit, Railway, Render, Netlify, and others.

But the part of the conversation that really stuck with me was about skills.

The point Tanner made

It was a simple one:

Someone can download something that looks like a TanStack skill, but that skill can have a whole bunch of other stuff embedded in it.

That's the problem.

As skills become mainstream, the people installing them increasingly won't be developers. They're not going to read the source code. They're going to see a familiar name and trust what they're installing.

But do they know:

  • Where the skill came from?
  • Who maintains it?
  • What access they just handed over?
  • Whether the skill has changed since they installed it?

Why the open source work matters

This is exactly why what Tanner and the TanStack team are doing in the open matters. The easier it is to identify and maintain the trusted version, the harder it becomes for a malicious or outdated version to hide in plain sight.

A familiar name is not provenance. Provenance is knowing which one is the real one, who stands behind it, and when it last changed.

And to be clear, none of this makes me more cautious about skills. I'm still telling everyone to install the Netlify skill. Skills are incredibly powerful because they give an agent the current instruction manual instead of relying on whatever it remembers from its training data. That gap between what a model remembers and what a platform can actually do today is enormous, and a skill is what closes it.

The question I'd now add

I think there's another question every company needs to ask:

Who maintains the skills our people are using, and how do we know when they change?

That's not just a developer question.

It's a governance question.

And very soon, it's going to be an enterprise question.