AI Agent Skills Are a Fresh Supply Chain Risk: What to Vet and How to Run Them Safely
Agent skills turn a package install into a live compromise if the instructions carry prompt injection. HiddenLayer's attacks show a skill can bypass approval prompts and persist in agent memory, so anyone running an agent with a human's permissions needs the same sandboxing and version discipline they already use for dependencies.
AI agent ecosystems now let developers install "skills" that bundle natural-language instructions, scripts, and resources into a folder. Installing one is like granting a colleague with your own permissions access to your machine, and the security story is blunt: you cannot see at a glance what that colleague brings. HiddenLayer's work on Claude Code shows skills can bypass permission prompts, hide malicious actions, pollute the agent's long-term memory, and open a new AI supply chain risk. A separate benchmark called Skill-Inject measures how easily agents follow harmful instructions hidden in skill files, warning that malicious skills are flooding in.
The core flaw is indirect prompt injection: the agent cannot reliably separate the model's user intent from attacker-planted commands inside the text it reads. Absolute proof of safety is out of reach, because natural language carries no malicious signature, behavior can be delayed or conditionally triggered, and the model itself can be persuaded even when the script is clean. So the practical goal becomes risk reduction: shrink the trust scope, limit the blast radius, keep audit trails.
Concrete defenses span the full lifecycle. Before install, prefer official or self-written skills and flag one-click installers. Read all of SKILL.md and scripts, using grep patterns to catch curl, base64, eval, and access to .ssh or .env. At runtime, require per-action confirmation, run in containers or VMs, use scoped temporary credentials, whitelist outbound network, and watch memory files. After install, pin versions in Git and review diffs, treat third-party skills like dependencies, and use a model pre-review only as an aid, never as a judge. The layers are deliberately redundant, since any single one leaks.
Natural-language instructions are the new attack surface for code review; even if scripts are clean, a model can be steered into dangerous actions by the text it reads, so static analysis alone is insufficient.
The "good-first-bad-later" pattern (delayed or conditional triggers) means a skill can pass review now and fail after deployment, which is why Git pinning and diff review of updates matters.
The article frames the isolated environment as the backstop, not the source or review layers, because no single vetting step is airtight; account hijacking can compromise a trusted source, and review can't read every variant.