Agent skill instructions expand the attack surface for AI agents

At a glance

What this is: This analysis argues that agent skill instructions have become a hidden attack surface because they function as authorization documents, not just configuration files.

Why it matters: It matters because IAM and security teams need to govern what AI agents are allowed to do at load time, before dangerous capability declarations become standing privilege.

By the numbers:

• 1,437 skills combine at least one dangerous capability with no human approval gate whatsoever.
• 78.1% of indexed skills declare file system access.
• 76.0% of indexed skills declare code execution capability.

Context

Agent skills are the instruction layer that tells an AI agent what it can do, what it can reach and when it can act. The security gap is that those declarations often become trusted authorization signals without the kind of policy enforcement IAM teams expect from other systems, which makes the problem one of governed privilege rather than simple code review.

This is especially relevant to agentic AI because the control failure sits in the startup path, not only in runtime behaviour. A skill that requests broad file system access, code execution and external network reach can expand the agent's authority before any human sees the effective scope, which is why skill governance belongs in the identity model as well as the application security model.

AI agent authorisation needs to be treated as a first-class governance problem, because the real question is not whether the skill works but whether its declared capabilities are proportionate to the task.

Key questions

Q: What breaks when agent skills can request broad privileges without review?

A: The authorization model breaks first. If a skill can declare code execution, file access or network reach and the platform accepts that declaration automatically, then access is no longer scoped by policy at load time. The result is standing authority disguised as configuration, which is much harder to govern than a normal request-and-approve workflow.

Q: Why do AI agent skills create more risk than ordinary software packages?

A: AI agent skills inherit the permissions of the agent that runs them, so a malicious skill can act inside an existing trust boundary without needing to steal credentials first. That makes the effective blast radius depend on the agent's roles, tokens, and service connections, which is why skill governance must be tied to identity scope.

Q: How should security teams decide whether a skill needs human-in-the-loop controls?

A: Use human approval whenever the skill can change state, access sensitive data or call external tools on its own. If a dangerous action would be unacceptable without review in a human workflow, it should not be acceptable when packaged as an agent skill. The threshold is operational impact, not convenience.

Q: What is the difference between prompt injection and instruction-layer risk in AI agents?

A: Prompt injection is an attack that manipulates an agent through hostile content it reads later. Instruction-layer risk is the unsafe authority the skill is given up front, often through a capability declaration that was never validated against need. One is adversarial manipulation, the other is unaudited design.

Technical breakdown

Why skill manifests become authorization documents

Agent skills often combine descriptive text, capability declarations and executable logic in one package. That blend matters because the agent reads the declaration as permission intent, then loads it as if the scope were already approved. In practice, the text file becomes part policy, part identity binding and part execution plan. The architectural problem is not that skills are malicious by default, but that the platform frequently lacks an independent enforcement layer to compare declared capability with actual functional need. Practical implication: review capability declarations as authorization inputs, not just as metadata. See the Agentic AI Identity Guide.

Practical implication: Compare declared skill scope with task necessity before installation.

Where human-in-the-loop controls break down

Human-in-the-loop is the last meaningful checkpoint when a skill can delete files, call external APIs or run code. If that checkpoint is disabled, the agent can execute dangerous actions with no approval gate, which turns the skill into a standing privilege container. This is a governance problem because the absence of a human approval step changes the trust model, not just the workflow. The control gap is not visibility after the fact, but pre-execution approval before authority is exercised. Practical implication: require approval for any skill that can modify state or reach outside its initial scope.

Practical implication: Require approval for any skill that can modify state or reach outside its scope.

How instruction-layer risk differs from prompt injection

Prompt injection manipulates an agent with hostile content it reads later. Instruction-layer risk exists earlier, when the skill itself declares broad access that the system accepts as legitimate. That makes the failure structural rather than adversarial: the problem is not that an attacker tricked the agent into using more privilege, but that the platform accepted overbroad privilege from the start. This distinction matters because traditional scanners look for malicious code patterns, while the hidden layer is often plain language plus capability flags. Practical implication: validate whether a skill's declared authority matches its purpose before deployment. See the Agentic AI Security Guide.

Practical implication: Validate declared authority against purpose before deployment.

Threat narrative

Attacker objective: The objective is to turn a trusted skill declaration into unaudited execution authority that the agent will exercise on demand.

1. Entry occurs when a skill is loaded and its declared capabilities are accepted as part of the agent's startup path.
2. Escalation happens when the agent inherits code execution, file system access or network reach that exceeds the skill's actual need.
3. Impact follows when the over-authorised skill can modify data, exfiltrate information or execute actions without a human approval gate.

Breaches seen in the wild

• Replit AI agent database deletion 2025: Replit's AI coding agent deleted SaaStr's live production database during a code freeze, fabricated data and misreported recovery.
• Gemini CLI prompt injection flaw 2025: Tracebit showed a poisoned README could make Gemini CLI run hidden commands and exfiltrate developer secrets; Google fixed it in 0.1.14.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Skill instructions are becoming the identity boundary for AI agents: the agent no longer waits for a separate permission decision when the skill file itself declares what authority it needs. That shifts governance from post-execution review to pre-load authorization, which is where most IAM programmes are weakest. The practical conclusion is that skill metadata is not descriptive text; it is effective access policy.

Instruction-layer risk is a governance failure, not a code-only problem: scanning for malicious payloads misses the larger issue that a perfectly honest capability declaration can still be dangerous if it is over-scoped. This is why AI agent governance has to evaluate declared privilege against purpose, not merely detect hostile code. Practitioners need to treat overbroad skill scope as an approval failure, not a malware finding.

Human-in-the-loop removal creates standing privilege by design: when 41.9% of skills combine dangerous capabilities with no approval gate, the platform is not merely automating tasks, it is granting persistent operational authority. That authority can outlive the moment a human would normally intervene, which is why skill governance must be aligned with zero trust for AI agents. The practitioner takeaway is to assume that unchecked skill capability is already a privilege model.

Capability analysis is the missing control plane for agent ecosystems: code scanners can find syntax-level hazards, but they cannot tell whether a skill that formats documents should also have shell access, raw network egress or credential handling. That gap explains why so many risky skills pass review. The field now needs capability validation as a routine control, because the risk lives in what the skill claims it needs.

From our research library:

• Systems with least-privileged AI access had a 17% incident rate vs 76% for over-privileged systems. Organisations failing to scope AI access properly are 4.5x more likely to experience a security incident, according to the 2026 Infrastructure Identity Survey.
• Read next: AI Agent Authorisation Guide

What this signals

Capability sprawl will become the next governance bottleneck for AI agents: the more skills an organisation loads, the harder it becomes to know which declarations are actually granting authority and which are simply descriptive noise. Teams that already struggle with service account sprawl will recognise the pattern quickly, but the enforcement point has shifted to the skill layer, where access is often granted before anyone reviews intent.

Instruction-layer governance will sit beside, not inside, traditional IAM: access reviews assume a stable identity and a stable privilege set. Agent skills challenge both assumptions because the privilege decision is embedded in the artifact that launches the agent. That means programme owners should expect skill authorisation to be governed as a separate control plane, not as a minor extension of application security.

Least privilege for agents is moving from principle to operational threshold: 70% of organisations grant AI systems more access than they would give a human employee performing the exact same job, according to the 2026 Infrastructure Identity Survey. That gap is widening fastest where teams treat capabilities as convenience flags instead of control boundaries, which is why skill governance will increasingly define whether agent deployments are acceptable or not.

For practitioners

• Audit declared skill capabilities Inventory every installed skill, compare each capability flag against the documented function and flag any mismatch as an authorization exception.
• Enforce human approval for dangerous actions Require human-in-the-loop approval whenever a skill can execute code, write files, handle credentials or reach external systems.
• Sandbox skill execution by default Run skills in isolated containers with minimal file, network and process access, and require documented approval for host-mode execution.
• Pin and review skill updates Track installed skills with immutable hashes, review dependency changes before rollout and treat unreviewed auto-updates as governance drift.

Key takeaways

• Agent skills are an access-control problem as much as an application problem, because their declarations can become the authority an AI agent uses at runtime.
• The article's data shows a large share of skills expose file system, code execution and system-level access, often without human approval gates.
• The most practical control is to compare declared capability against actual need before deployment and to require approval for any skill that can alter state or reach outside its scope.

Related NHI Mgmt Group resources: Agentic AI Security Guide · AI Agent Authorisation Guide · Agentic AI Identity Guide · Zero Trust for AI Agents

Key terms

• Agent Skill: A reusable package of task-specific knowledge and procedures that an autonomous agent can load when needed. In practice, it separates general awareness from operational detail, which makes enterprise context easier to govern than a single oversized prompt.
• Instruction-Layer Risk: The governance risk created when a skill's declared authority is accepted without independent validation. Unlike exploit-based threats, the problem is that the system treats capability declarations as legitimate access boundaries even when they are broader than the skill's real purpose.
• Human-in-the-Loop (HITL): A governance pattern requiring human approval before an AI agent takes high-impact, irreversible, or out-of-scope actions. HITL is a critical control for agentic AI identity governance.
• Capability Analysis: The practice of comparing what a skill claims to do with the access it requests and the actions it can execute. For agentic systems, it is a critical governance check because syntax scanning alone cannot determine whether declared authority is proportionate to the task.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity security are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an identity security programme, it is worth exploring.