I've had more luck writing my own skills using CLI tools I know and trust.
IMO, yes. Gemini et. al. out of the box are good at composing, but are entirely passive. Skills enable you to - easily, with low code/no code - teach your AI to perform active tasks either upon direction or under any automatic conditions you specify. This is incredibly powerful. Incredibly dangerous, too, but so is a car when compared with a skateboard.
- I click skills.
- The first one is WireGuard "... secure routing and key management".
- I'd download it, hook it to this bot running on my system.
- I'd ask the bot to store / manage super-secret keys that protect actual servers with user data and personal details and god knows what...
- The bot follows my commands by spelunking random snippets of markdown, running other programs on my computer, doing web searches, reading what it finds on the web and giving itself more commands to do...
I've only been in tech for like 20 years or so but I feel like either I'm missing something substantial or some kind of madness is happening to people.
People are extremely eager for a helpful AI assistant that they are willing to sacrifice security for it. Prompt injection attacks are theoretical until they hit you. Until you're hit you're just having fun riding the wave.
It is WILD how little “professionals” actually understand about systems, security, or really computers in general.
Can't you just read it?
"Don't worry, we have stars."
Itchy and Scratchy land is open for business.
Sigh, when I read this and only understand "npm", I feel like retiring.
