Here's the answer: skills turn a general assistant into specialist staff, and most founders need only six to ten of them, but every third-party skill deserves the same scrutiny as a contractor with keys to the building. A skill is a folder of instructions and resources your assistant loads when the job calls for it. A malicious or sloppy one can leak what it can see or quietly redirect your assistant's behavior.
The five vetting rules: install only from official directories or named, reputable authors, never a random file from a DM. Read it, because skills are readable text, and look for anything that sends data outward or asks for credentials. Question every permission, because a formatting skill needs no email access. Test first runs in a throwaway Project with nothing sensitive attached. And review the roster quarterly, because every dormant skill is dormant risk. The convenience of installing is always visible. The risk never is.
Then build your own, no code required: describe the procedure, answer the interview, save. The test for what deserves to become a skill is anything you've explained twice.
And build the voice skill first. It holds your voice rules, five to ten annotated real examples, the banned list, and per-format guidance. Every piece of outbound writing runs through it, and every correction you make twice goes into it. That compounding is what makes month three unrecognizably better than week one.
The full skill playbook is Volume 3 of our Build with QYRAI™ series.
Hire the specialists. Vet the keys.