The artifact that tells you “this app already exists” is the same artifact that tells you “this app reaches the filesystem.”
Why Skills Files Matter Now
A new app request lands on the platform team’s desk. Before anyone writes a line of code, the right first move is a lookup, not a build: has someone in the estate already solved this? In a mature agent rollout — thousands of vibe-coded apps, Copilot agents, and CLI assistants — the answer is yes more often than anyone expects. The problem is that nobody holds the index.
Here’s the part that gets missed: the index already exists. It’s sitting in the skills files, agent files, and MCP manifests scattered across your repos and endpoints. These are declarative, machine-readable artifacts — each one describes what an agent does, what tools it loads, and what it’s allowed to touch. Read together, they are a map of the estate. Almost nobody reads them together.
| Signal | What we see |
|---|---|
| Unsanctioned agents on audited endpoints | 88% of environments in Ospiri’s signature pipeline surface at least one |
| Guardian-agent budget trajectory | Gartner projects 5–7% of agentic AI spend by 2028, up from under 1% today |
| Cost of the ungoverned alternative | +$670K in Ospiri’s published incident modeling |
| Skills/manifest coverage in most orgs | Effectively zero — the files exist, the scan doesn’t |
The market is about to fund this layer. The question is whether you treat it as a compliance chore or as the cheapest source of alpha in your AI program.
The Same Artifact, Two Reads
Think of each skills file as a position disclosure. A trading desk reads a 13F two ways: what is this fund long, and what risk is it carrying? A skills file supports exactly the same dual read.
| Dimension | The reuse read | The risk read |
|---|---|---|
| Declared capability | “A team already built invoice reconciliation” | “This skill spawns a shell process” |
| Tool imports | Which connectors are proven in production | Which MCP servers came from an unvetted public repo |
| Data scope | Which data domains the estate already serves | Which skills reach NPI, source code, or credentials |
| Provenance | Internal author to consult before rebuilding | Anonymous GitHub account, last commit 3 weeks ago |
| Permission grant | What access a duplicate would need anyway | Over-permissioning versus the stated use case |
One scan, two verdicts. The reuse verdict de-emphasizes the duplicate before a second team burns a quarter rebuilding it. The risk verdict flags the over-permissioned or malicious skill before it’s handed broad access. Same read of the same file, booked to two different P&Ls.
What the Scan Actually Finds
Field notes from running this against real estates, in rough order of frequency:
- Duplicates. The same document-summarization or data-pull pattern rebuilt independently by multiple teams, each with its own credentials and its own private copy of org context. Pure duplication tax.
- Permission drift. A skill whose stated purpose is “format quarterly reports” importing a filesystem tool with read access to the entire home directory. Not malicious — just the default scope nobody trimmed.
- Public-repo imports with no reputation check. Skills and MCP servers pulled straight from public repositories into production workflows. The file names the source; nobody checked it. This is executable capability, not documentation.
- Dead positions. Skills referencing decommissioned endpoints and stale credentials — apps nobody retired, still holding access grants. In portfolio terms: positions left on the book after the desk stopped trading them.
- The occasional live threat. A skill whose declared behavior and actual tool imports don’t reconcile. Rare, but the whole reason the reputation layer exists.
Scoring the Book
You can’t review thousands of manifests by hand, and you shouldn’t. Rank them:
Scan Priority = (Permission Scope × Data Sensitivity) + (Provenance Risk × Install Base)
| Factor | What it measures | Cheap proxy |
|---|---|---|
| Permission Scope | Filesystem, network, process, credential reach declared in the file | Count of tool imports by category |
| Data Sensitivity | Classification of the domains the skill touches | Map declared paths to your label taxonomy |
| Provenance Risk | Where the skill came from and who maintains it | Internal repo vs. public pull, commit history |
| Install Base | How many endpoints load this skill | Manifest occurrence count across the estate |
A widely installed, internally authored skill with narrow scope scores low — leave it alone. A public-repo skill with filesystem reach on fifty developer laptops scores high — that’s your review queue, pre-sorted.
The Declared Map Still Needs Ground Truth
Let’s be honest about the limit: a skills file is a self-report. It’s what the builder said the agent would do, frozen at publish time. It is not what the agent does at 2am three sprints later.
| Layer | What it gives you | What it can’t give you |
|---|---|---|
| Manifest scan | Estate-wide legibility in hours, no endpoint install | Whether behavior matches declaration |
| Reputation verdicts | Pre-grant screening of skills and MCP servers | Novel or modified payloads |
| Kernel-level observability | What each process actually opened, spawned, sent | Nothing — this is the ground truth |
| Kernel-level enforcement | In-line containment when declared ≠ actual | — |
The scan makes the estate legible; the kernel makes it honest. Reconciling declared footprint against actual behavior is the control loop — the same way a fund reconciles stated strategy against actual fills. Drift between the two is itself the signal.
What CISOs Should Do This Quarter
| Step | Action | Output | Effort |
|---|---|---|---|
| 1 | Inventory skills files, agent files, and MCP manifests across repos and endpoints | Estate map with occurrence counts | Days |
| 2 | Score the book with the priority formula above | Ranked review queue | 1 week |
| 3 | Route the queue two ways: duplicates to the platform team, high-risk skills to security review | Reuse wins and revoked grants | 2–3 weeks |
| 4 | Stand up reconciliation: declared footprint vs. kernel-observed behavior on the top-decile skills | Drift report, enforcement candidates | Ongoing |
The Bottom Line
The skills-file layer is the cheapest place to make your AI estate both legible and safe — one scan of artifacts you already possess answers “what can we reuse?” and “what should we fear?” simultaneously. Most organizations are paying the duplication tax and carrying the reputation risk at the same time, because nobody assigned an owner to files that machines write and no human reads. The scan is fast precisely because the format is declarative; the follow-through requires kernel ground truth, because declarations drift. If your team is sizing this for the fall planning cycle, request a working session. We will walk through your environment, run the manifest scan against a slice of your estate, and scope a deployment. Ninety minutes gets you the ranked queue.