Answer
Why are skills and MCP servers the new npm?
Skills and MCP servers are the new npm because an agent installs a stranger's instructions and then runs them with your credentials. The package is text, the install is one line, and the access is whatever the agent already holds.
Manoj Nair of Snyk made the comparison on The AI Native Dev on 20 October, in the section that starts at 11:18: "skills and MCP servers are the new NPM of these agents". The same passage carries the sharper line: "three lines of English can be malware". A skill does not need a compiled payload. It needs a sentence the agent will follow.
What is different from npm?
A dependency declares code. A skill declares intent, and intent is what the agent acts on. The public ToxicSkills audit of 3,984 agent skills found 534 with at least one critical issue (13.4 percent), 1,467 with any issue (36.82 percent) and 76 confirmed malicious payloads, with 8 still available at publication. The payloads were credential theft, backdoor installation and data exfiltration, carried in the markdown.
What did enterprises do about it?
The episode describes the common enterprise answer at 15:28: skills scanning and MCP scanning, a secure sandbox such as Docker, and separate identities for agents, with each agent treated as a teammate and locked out of the open internet. The same passage calls dynamic, ephemeral authorisation an unsolved problem with proofs of concept, which is why the manifest check matters: it is the part you can do now.
Where does approval fit?
Before the agent runs. The manifest is the only artefact every harness shares, and it carries the source, the pin, the scope, the sandbox, the identity and the logging in one place. A check that reads it takes seconds and gives the reviewer a rule and a fix.
Source note. The comparison comes from The AI Native Dev, 20 October, at 11:18 and 12:30. The skill counts come from the Snyk ToxicSkills audit. All sources.