Security for AI agent skills, plugins and instruction bundles (2026) — the supply chain of things that tell an agent what to do.