Why is a skill in OpenClaw treated as a trusted instruction source by the Agent Runtime?

Once a skill is loaded, its SKILL.md instructions become part of what the Agent Runtime treats as legitimate guidance for how the agent should behave, the same level of trust given to the agent's own core configuration.

• This is what lets a skill meaningfully extend the agent's behavior, since the agent actually follows what the skill's instructions say to do
• It's also exactly what makes a malicious or compromised skill dangerous, since the runtime has no separate mechanism distrusting instructions that came from a third-party skill versus the agent's own core setup
• Security researchers have flagged this operator-level trust as a governance gap, since a skill's declared permissions are self-reported with no independent runtime verification that its actual behavior matches

This is the architectural root of most OpenClaw supply-chain risk, the trust boundary between "core agent instructions" and "third-party skill instructions" is thinner than many operators assume.