Version control is the distribution mechanism
A skill is plain text in a directory, which is exactly what a repository is good at. Committing it means a pull request can change how the agent behaves, a reviewer can object, and a bad instruction can be reverted. Sending folders around instead gives every person a slightly different version within a month.
Scope decides where it belongs
Skills that encode how this codebase works go in this codebase. Skills that encode how the company works, and apply across repositories, are better kept in one place that the others pull from, so there is a single copy to correct when the convention changes.
Review descriptions as carefully as instructions
Two teams adding skills independently is the usual way descriptions start overlapping, and overlapping descriptions are what make the wrong skill win. It is worth reading a new skill's description against the ones already installed before merging it, which is a cheaper habit than debugging the collision later.