The AI agent security model is still forming. Review-before-run is the same principle as hardware wallet verification — trust code, verify execution. Agents with keys need the same paranoia as humans holding Bitcoin. One compromised skill is one bad transaction.