What Is Untrusted Skill? Definition & Examples

An untrusted skill is external executable logic, code, or instruction content that an AI agent can import into its workflow. It matters because the skill can read secrets, alter agent behaviour, or create a hidden execution path into sensitive systems.

What an Untrusted Skill Is

An untrusted skill is external executable logic or instruction content that an AI agent can import into its workflow. The term matters because the imported skill can influence agent behaviour, handle sensitive context, and become an execution path the operator did not explicitly intend.

Where the Trust Boundary Breaks

The key issue is not whether the skill is useful, but whether it arrives from outside the agent’s trusted control plane. Once a skill can run inside the agent’s working context, it may inherit access to prompts, tools, connectors, or credentials that were never meant to be exposed to third-party logic. That makes the trust boundary behave more like code execution than simple content consumption.

In practice, the danger increases when the skill can chain into other components, such as retrieval, tool calls, or permissioned workflows. OWASP Agentic Skills Top 10 (AST10) frames that skill layer explicitly, including malicious skills and permission inheritance across agentic skill chains.

Security Implications

Untrusted skills can expose secrets, distort decision-making, and create hidden actions that are hard to spot during normal review. The security impact is often indirect at first, because the skill may not break anything immediately; instead, it quietly widens the agent’s effective authority or changes how the agent interprets instructions.

This is also why untrusted skills belong in the same broader control conversation as agent privilege, secret handling, and runtime authorization. AST10 is useful here because it treats the skill itself as a security object, not just a convenience layer.

Common Failure Modes

The most common failure mode is treating imported skills as if they are harmless configuration. In reality, a skill can contain prompts, code, dependencies, tool instructions, or embedded behaviours that alter execution in ways the operator may not notice until after sensitive actions have occurred.

Another failure mode is assuming provenance alone is enough. Even a skill from a familiar source can become unsafe if it is overly privileged, stale, or capable of reaching data and tools outside its intended scope. That is why skill review has to consider both content and execution context.

Risk and Threat Considerations

Untrusted skills create a real attack surface because they can smuggle malicious instructions into the agent runtime, redirect tool use, or harvest data the agent can access. The risk grows when skills are shared, reused, or installed without a strong trust review, because the same logic can propagate across many workflows.

Failure mechanism: A malicious or compromised skill leverages the agent’s execution authority, then uses that authority to read context, influence decisions, or call downstream tools in ways the operator did not anticipate.

Impact: The result can be secret exposure, unauthorized actions, corrupted outputs, lateral movement into connected systems, or a persistent hidden path for abuse inside the agent workflow.

Standards & Framework Alignment

This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.

OWASP Agentic AI Top 10 and MITRE ATT&CK address the attack and risk surface, while OWASP ASVS sets the governance and control requirements practitioners need to meet.

Framework	Control / Reference	Relevance
OWASP ASVS	V15 — Secure Architecture	Untrusted skills are executable logic that must preserve isolation and trust boundaries.
Recommendation — Validate imported skill execution paths and isolate them from sensitive agent context.
OWASP Agentic AI Top 10	ASI02 — Tool Misuse	Skills can steer an agent into unsafe tool use and hidden actions.
	ASI03 — Identity & Privilege Abuse	Untrusted skills can expand what the agent can access or do through inherited authority.
	ASI04 — Agentic Supply Chain Vulnerabilities	Skills are external components whose provenance and integrity affect agent security.
Recommendation — Restrict skill-driven tool invocation to explicitly approved and bounded actions. Constrain agent and skill privileges so imported logic cannot inherit excess authority. Review skill provenance and integrity before allowing it into the agent workflow.
MITRE ATT&CK	T1218 — Signed Binary Proxy Execution	Imported skill logic can act as a trusted execution proxy for malicious behaviour.
	T1552 — Unsecured Credentials	Skills may expose secrets or encourage access to credential material.
Recommendation — Hunt for proxy execution patterns when external skill logic triggers unexpected actions. Monitor skill paths that can read or leak credentials and other secret material.

Practitioner Guidance

What to watch for: Treat imported skills as executable supply-chain inputs, not as passive prompt text. The most important question is whether the skill can expand the agent’s effective authority, touch sensitive context, or alter tool behaviour without an explicit approval step.

Governance implication: Ownership should sit with the team that approves agent capabilities, not with whoever happened to install the skill. Skills need the same kind of provenance, review, and scope discipline you would expect for any external logic that can influence privileged execution.

Practitioner takeaway: If a skill can change what the agent is allowed to see or do, it is part of the security boundary and should be treated that way.

Untrusted Skill