They often review the visible text and forget that the agent reads raw content, not a rendered browser view. Hidden Unicode, bundled scripts, and silent network calls can all survive casual inspection. A safe review process needs raw-file analysis, malware scanning, and explicit approval for updates after the first install.
Why This Matters for Security Teams
Community AI agent skills are not just documentation assets or UI-rendered snippets. They are executable supply-chain inputs that can change what an agent reads, sends, stores, and invokes. That makes review a control problem, not a content-check problem. Security teams that inspect only the visible browser view miss hidden Unicode, embedded scripts, and network behavior that the agent may process directly. Guidance from the OWASP Agentic AI Top 10 and the NIST AI Risk Management Framework both point toward runtime risk, not just source visibility.
This matters because a skill can look harmless in a gallery while still instructing an agent to call external services, pull in remote content, or leak context through tool use. NHIMG research on AI Agents: The New Attack Surface report shows how often agents already exceed intended scope, which is exactly why review has to extend beyond the rendered page. In practice, many security teams discover the danger only after the skill has already been installed and the agent has begun executing it.
How It Works in Practice
A defensible review process starts with the raw package, not the gallery preview. Security teams should examine the actual file contents the agent will ingest, including YAML, JSON, markdown, embedded code blocks, templates, and any referenced assets. The question is whether the skill can alter agent behaviour, not whether the page looks clean. Current guidance suggests treating community skills like third-party software dependencies, with malware scanning, provenance checks, and change control before first use.
For agentic environments, a useful review path is:
- Open the raw artifact and compare it to the rendered version.
- Search for hidden Unicode, obfuscated text, comment-based instructions, and encoded payloads.
- Inspect bundled scripts and prompt fragments for tool invocation, exfiltration paths, or remote fetches.
- Trace all network calls, including silent callbacks, webhook targets, and telemetry endpoints.
- Require explicit re-approval for updates after installation, even if the skill name is unchanged.
That approach aligns with NHIMG coverage of OWASP NHI Top 10, especially where agent permissions and trust boundaries are crossed. It also matches the threat-modeling emphasis in the CSA MAESTRO agentic AI threat modeling framework, which focuses on how tool access, memory, and external calls compose into risk. Teams should assume that a skill can be updated after publication, so the control objective is continuous verification, not one-time approval. These controls tend to break down when skills are auto-imported into production agents because the review workflow never sees the raw artifact before execution.
Common Variations and Edge Cases
Tighter review often increases friction for builders, requiring organisations to balance fast adoption against supply-chain safety. That tradeoff is especially visible with community-maintained skills, where useful functionality and untrusted code can exist in the same package. Best practice is evolving, but there is no universal standard for what qualifies as a safe agent skill review yet.
Edge cases usually involve skills that are mostly declarative but still embed risky behavior through remote references, auto-updating dependencies, or obfuscated prompt instructions. Some teams assume that a signed repository or popular marketplace listing is enough. It is not. A trustworthy badge does not prove the raw content is clean, and it does not stop an agent from executing instructions hidden outside the visible text. NHIMG’s Analysis of Claude Code Security and CoPhish OAuth Token Theft via Copilot Studio both reinforce the same lesson: the weak point is often the trust path, not the visible interface.
Where teams have mixed maturity, the safest policy is to block direct production installation of unreviewed skills, require a staging environment, and keep an allowlist of approved publishers. This guidance becomes harder to apply in highly dynamic environments where skills are fetched on demand, because the review window can disappear before analysts can inspect the raw package.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Agentic AI Top 10, CSA MAESTRO and OWASP Non-Human Identity Top 10 address the attack and risk surface, while NIST AI RMF and NIST CSF 2.0 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| OWASP Agentic AI Top 10 | A7 | Addresses supply-chain risk in agent skills and hidden instruction abuse. |
| CSA MAESTRO | T4 | Covers agentic tool-chain trust and malicious behavior hidden in skills. |
| NIST AI RMF | Supports governance for risky AI behavior and lifecycle review of agent assets. | |
| OWASP Non-Human Identity Top 10 | NHI-05 | Relevant because skills often embed secrets, tokens, or deceptive instructions. |
| NIST CSF 2.0 | PR.IP-3 | Change control is needed when skill updates can alter agent behavior. |
Scan imported skills for secrets exposure, hidden payloads, and unauthorized outbound calls.
