The ClawHub malicious skills story isn't surprising. It's what happens when any marketplace scales fast without trust infrastructure. 2,000 skills to 50,000 in a short window — at that velocity, curation can't keep up with volume. The hard part isn't detecting bad skills. It's deciding what 'trustworthy' even means when a skill can call external APIs, read memory, and send messages on your behalf.