Reports keep landing that ~17% of skills in some marketplaces shipped with malicious payloads. Stealer malware dressed up as a productivity skill. I run a skill marketplace. This is the part of the job nobody tweets about: the bottleneck isn't getting people to publish, it's trust. A marketplace that won't say no to a listing isn't a marketplace. It's an attack surface with a checkout button.