Skills are becoming the unit of distribution

Cloudflare published a security auditor this week. It is not a product, not a service, and not an API you send code to.

It's a folder. A SKILL.md, some reference files, two Node validators with no dependencies, MIT licensed. You install it with one command and any coding agent that supports tool use and parallel sub-agents can run it.

The security content is good. The packaging is the interesting part.

What's actually in it

Six stages, and the shape of them is worth copying regardless of what you're building.

Reconnaissance maps architecture, trust boundaries and input surfaces into an architecture.md and a coverage ledger. Hunters get dispatched from units in that ledger, in isolation, with "coverage critics" whose job is finding the gaps the hunters left. A separate verifier then tries to disprove each candidate finding. Output goes to a JSON schema with three buckets — confirmed, needs validation, rejected — and the two bundled validators enforce that schema, with tests.

The methodology files are split by domain: memory safety, prompt injection and agent tool handling, web protocol and auth, supply chain, cloud deployment, resource exhaustion, data isolation, local IPC.

Two of their stated principles are the ones I'd steal:

The checking agent is never the finding agent. Adversarial validation as a structural rule, not a suggestion. An agent grading its own homework is the single most reliable way to generate confident nonsense, and the fix is not a better prompt, it's a different agent with a different job.

Severity requires impact. Likelihood times impact, not deviation from a checklist. A missing redundant control, where an existing layer already blocks the attack, is a hardening note — not a vulnerability. That one line would delete half the output of most automated security tooling.

They're also honest about the limit: a single run surfaced roughly half of what repeated runs found cumulatively. Runs are additive, not deterministic. Publishing that number instead of a "99% detection" claim is why I trust the rest of it.

Why the folder matters more than the contents

We already had ways to ship code. npm, PyPI, containers, SDKs. What we didn't have was a way to ship judgment — the sequence somebody experienced follows, what they check first, what they refuse to call a finding, when they stop.

That's what a skill is. Markdown describing a method, a few scripts where determinism is required, and a trigger that fires when the request matches. No server, no runtime, no vendor.

A package gives an agent a new capability. A skill gives it a new procedure. Those are different products, and until recently only one of them had a distribution format.

I have 378 of these indexed locally across 13 categories, and the number is the reason I care about the format. Past about fifty, a flat list stops being navigable — the agent can't hold it, and neither can I. Mine now goes through a two-level index: match the task to a category, read that category file, pick the skill. That's not a clever architecture, it's the minimum thing that works once the collection outgrows a single file, and the fact that I needed it at all is the signal.

The uncomfortable part

If methodology is the distributable unit, then methodology is also the thing that rots.

A package with a stale dependency fails loudly. A skill encoding a method that stopped being right just keeps producing plausible output in the old shape, and nothing errors. Cloudflare's skill will need updating every time the threat landscape moves, and there's no build failure to tell anyone it's overdue.

So the format is real and the maintenance story isn't written yet. Ship the folder, absolutely — but put a date in it, and treat a skill nobody has touched in a year the way you'd treat a lockfile nobody has touched in a year.