01What Agent Skills are
An Agent Skill is a directory containing a SKILL.md file: YAML frontmatter with the required fields "name" and "description" plus Markdown instructions; optionally, the directories scripts/ (executable code), references/ (documentation) and assets/ (templates, data) are added. Agents load skills via progressive disclosure in three stages: at startup only the name and description (around 100 tokens), on activation the full instructions, and scripts and reference files only when needed – scripts are executed via the shell, and only their output enters the context. The format was developed by Anthropic, released as an open standard (agentskills.io) and is supported by numerous agents, including Claude and Claude Code, GitHub Copilot, VS Code, Gemini CLI and OpenAI Codex.
02Prompt injection via skill content
Skill instructions enter the agent's context directly, as seemingly trustworthy guidance. Anthropic explicitly warns: a malicious skill can instruct the agent to invoke tools or execute code in ways that do not match the skill's declared purpose – for instance hiding actions from the user or changing behavior only under specific conditions. This matches the pattern of indirect prompt injection (OWASP LLM01:2025): content from external sources alters model behavior in unintended ways. Skills that fetch content from external URLs at runtime are particularly risky – even an originally benign skill can become compromised if its external dependencies change later.
03Supply chain risk: skills from third-party sources
Skills are shared like software packages – via Git repositories, plugin catalogs and community marketplaces. Anthropic recommends using only skills from trusted sources and treating the installation of a skill with the same care as installing software on production systems. Typical risk indicators are bundled scripts (they run with full access to the agent's environment), hardcoded credentials, references to MCP servers (they extend access beyond the skill itself), network access, and file paths outside the skill directory. Since skills can change with every update, each new version counts as a new deployment – with a renewed security review.
04Excessive permissions and data exfiltration
A skill does not bring its own permission model; it inherits the privileges of the executing agent – and these differ considerably depending on the runtime environment: in the Claude API, skills run in a sandboxed container without network access, whereas in Claude Code they run with the full network access of the user's machine. The combination of read access to sensitive data and outbound communication is where it gets critical: Anthropic explicitly names the interplay of file-read and network tools as a combined risk; exfiltration is also possible through the agent's own responses. The experimental frontmatter field "allowed-tools" can restrict which tools may be used, but it is not enforced by every implementation – it is no substitute for hardening the runtime environment.
05Vetting approaches: review, sandboxing, allowlisting, signing
Approval starts with a complete review of all files in a skill: SKILL.md, referenced Markdown files, scripts and resources – looking for adversarial instructions (ignore security rules, hide actions), network access, hardcoded credentials, unexpected redirect targets and exfiltration patterns. Bundled scripts should be executed in an isolated sandbox to verify that their behavior matches the declared purpose; for operations, additionally isolated environments such as containers without network access are a good fit. Allowlisting means that only explicitly reviewed and approved skills make it into use. The integrity of reviewed states is protected by checksums verified at deployment and by signed commits in the skill repository; in production, skills are pinned to specific versions.
06Governance: curated catalogs, least agency, audit trails
Organizations should manage skills through a curated internal catalog: a register per skill with purpose, owner, version, dependencies and evaluation status, plus segregation of duties – whoever writes a skill does not approve it themselves. The lifecycle spans creation and review through testing and deployment to monitoring and orderly decommissioning. The "Least Agency" principle from the OWASP Top 10 for Agentic Applications transfers least privilege to agents: grant only the minimum necessary skills, tools and scope of action – role-based skill bundles keep the active set small. For audit trails, Anthropic recommends application-level logging that makes it traceable which skills were loaded in which requests; regular re-evaluations uncover drift between skills, workflows and models.
