Prose is not documentation anymore
Research on Claude plugin repos shows natural-language instruction files and implementation scripts changing together at high rates. When SKILL.md says one thing and the script does another, you have a defect — the same class as mismatched API docs, except the “docs” execute through the agent.
That makes skills part of the software supply chain: they steer tools, files, and network calls on developer machines.
Version the whole unit
Pin plugin versions. Ship SKILL.md, tool policy, hooks, MCP config, and any scripts as one release. Record the digest your team approved. Rollbacks should restore the whole unit, not a half-updated markdown file.
If Claude co-authored large parts of the plugin, human review still owns the merge — co-authorship is not an audit.
Detect drift before users do
Semantic drift shows up as rising token cost, missing early exits, or new outbound hosts after a “small” skill edit. Scheduled published-surface audits catch that on the installer’s view of the repo.
Pair AuditHQ’s Claude plugin score history with your eval CI so cost and behavior both have a paper trail.
Install policy in one paragraph
Approved plugins only, least-privilege tools, documented hooks/MCP, no production secrets in local configs, and a named owner. Skills that cannot clear that bar stay off shared laptops.