They should block auto-execution of imported skill directories, enforce a strict file allowlist during installation, and add CI guardrails that ignore hidden skill paths. Those three changes cut off the easiest route from packaged content to secrets exposure and reduce the chance that a malicious or careless skill can persist in source control.
Why This Matters for Security Teams
Skill-based supply-chain risk is dangerous because it turns a simple install step into code execution, secrets exposure, and persistence in places teams rarely inspect. A packaged skill can arrive with hidden paths, embedded prompts, dependency hooks, or install-time side effects that bypass normal review. That makes the problem less about “untrusted code” in the abstract and more about what happens when content is treated as safe by default. Guidance from the OWASP Non-Human Identity Top 10 maps closely to this risk because packaged automation often carries credentials, tokens, and tool access that attackers can abuse. NHIMG’s research on incidents like the Mastra npm Supply Chain Attack shows how quickly trusted package channels can be weaponized when installation trust is too broad. The operational mistake is assuming that “skills” are lightweight configuration artifacts rather than executable supply-chain inputs. In practice, many security teams discover the problem only after a skill has already reached source control, CI, or a developer workstation.
How It Works in Practice
The fastest reduction in risk is to make installation fail closed. Auto-execution of imported skill directories should be blocked so that packaged content cannot run on arrival. Installation should accept only a strict file allowlist, which means the platform permits known-safe file types and rejects everything else by default. That includes hidden paths, dotfiles, nested scripts, launcher hooks, and surprise metadata that can trigger behavior outside the intended skill definition.
From there, CI guardrails should treat hidden skill paths as irrelevant unless explicitly approved. This matters because source control often becomes the secondary delivery path for malicious content once a skill is imported, renamed, or synced into a repo. A hidden path can preserve payloads that reviews miss, especially if automation only checks top-level manifests. Current guidance suggests combining repository checks with runtime installation policy so that both ingestion and later promotion are controlled. The NIST Cybersecurity Framework 2.0 supports this kind of layered control by tying governance to protection and detection outcomes, while the LiteLLM PyPI package breach and the Reviewdog GitHub Action supply chain attack show how package trust can be converted into broad downstream exposure.
- Disable auto-run behavior for imported skill bundles and require explicit approval before activation.
- Enforce a file allowlist at install time, not after deployment, so risky content never lands.
- Ignore hidden skill paths in CI unless a security control has specifically approved them.
- Scan imported skills for secret references, external callbacks, and install-time side effects.
These controls tend to break down in build systems that unpack skills into shared caches before policy checks can run, because the content has already been materialized and indexed.
Common Variations and Edge Cases
Tighter installation controls often increase developer friction, requiring organisations to balance security against package velocity. That tradeoff is real, especially when teams rely on third-party skill marketplaces or frequent internal skill updates. Best practice is evolving, but current guidance suggests that exceptions should be rare, logged, and time-bound rather than permanently whitelisted.
Edge cases include legitimate skills that need helper scripts, bundled binaries, or generated files. Those should be handled through signed allowlists, controlled build pipelines, or separate review paths rather than broad directory trust. Another common failure mode is assuming source review alone is enough. If the import process can execute code, then the risky step happened before code review ever had a chance to help. NHIMG’s broader breach analysis in the 52 NHI breaches Report reinforces a consistent pattern: once machine identities and automation trust are abused, the blast radius spreads quickly through connected systems. The practical answer is to reduce what imported content can do, not just what reviewers can see.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Non-Human Identity Top 10, OWASP Agentic AI Top 10 and CSA MAESTRO address the attack and risk surface, while NIST CSF 2.0 and NIST AI RMF set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| OWASP Non-Human Identity Top 10 | NHI-03 | Imported skills often carry secrets and persistent identity risk. |
| OWASP Agentic AI Top 10 | A3 | Skills can execute unwanted actions through hidden paths or hooks. |
| CSA MAESTRO | GOV-02 | Skill supply chains need governance over ingestion and approval. |
| NIST CSF 2.0 | PR.AC-3 | Access and execution should be limited to approved software behavior. |
| NIST AI RMF | AI risk management applies when skills can change system behavior. |
Block unsafe skill execution paths and require explicit runtime approval for tool-bearing content.
Related resources from NHI Mgmt Group
- How should security teams reduce supply chain risk in GitHub-based development pipelines?
- How should security teams reduce the risk of secret theft from npm supply chain attacks?
- How should teams reduce identity risk in cloud supply chain attacks?
- How can teams reduce software supply chain risk without slowing delivery?
