The boundary I'd keep explicit is that a skill can explain how to use a tool, but it can't be the only place where a security rule lives. The tool or server still needs to validate inputs and enforce the current user's permissions. That way the instruction helps the model, while the execution boundary protects the system even when the model ignores the guidance.