Agent skills need governance before malicious skills spread

At a glance

What this is: Akto’s analysis says agent skills are scaling quickly and that malicious skills are already being distributed through open ecosystems, turning employee-installed agent extensions into a governance problem.

Why it matters: For IAM, IGA, PAM, and NHI teams, the issue is not whether skills are useful, but whether installed agent extensions can be inventoried, assessed, and blocked before they inherit sensitive access.

By the numbers:

• The agent skill publishing rate went from under 50 in mid-January to over 500 by early February, a 10x increase in weeks.
• Researchers at OpenSourceMalware.com reported the first coordinated malware campaign targeting Claude Code and OpenClaw users in February 2026, involving more than 30 malicious skills distributed via ClawHub.

Context

Agent skills are modular instruction sets that agents can discover and invoke to complete tasks. In practice, they act like extensible non-human identity components because they inherit the agent’s permissions and can touch files, credentials, and communication channels.

The governance gap is straightforward: organisations can deploy agent tooling faster than they can inventory which skills are installed, what those skills can access, and whether they are trusted. Once a skill inherits shell access, file access, and embedded secrets, the control problem shifts from adoption to containment.

Key questions

Q: What breaks when a malicious skill inherits an agent’s permissions?

A: What breaks is the assumption that authorised execution is also safe execution. Once a skill inherits the agent’s permissions, it can use whatever the surrounding workflow already allows, including data access, tool calls, or financial actions. That creates a gap between declared purpose and actual power.

Q: Why do malicious skills create a bigger risk than ordinary code dependencies?

A: Malicious skills can influence what an agent does after load time, including tool selection, command execution, and data handling. Ordinary dependencies usually expose code paths, but skills can alter behaviour through instructions that look normal to a human reviewer. That makes them harder to spot and easier to operationalise at scale.

Q: How can security teams detect unsafe agent skills before they spread?

A: Teams need a combination of endpoint discovery and instruction inspection. Discovery tells you what is installed, while instruction review reveals whether the skill tells the agent to ignore guardrails, collect workspace data, or route information externally. Detection is only useful if it feeds a blocking decision before execution.

Q: Should organisations allow employees to install agent skills without review?

A: No, not if those skills can access files, credentials, or business communications through the host agent. Even a well-meaning productivity skill can become a data path if it inherits broad permissions. Review, allowlisting, and runtime policy are the minimum controls for employee-installed agent extensions.

Technical breakdown

How agent skills inherit access from the host agent

Agent skills are not isolated scripts in the usual sense. They run inside the trust boundary of the agent that loads them, so their effective privileges are defined by the host agent’s runtime permissions rather than by a separate sandbox. If the agent can read local files, access environment variables, or send messages through email and chat tools, the skill can use those channels too. That makes the skill a privilege extension mechanism, not just a convenience layer. The security implication is that instruction content becomes part of the access path. A harmless-looking skill can behave maliciously because its execution context already includes operational permissions that security teams often do not enumerate as a governed identity surface.

Practical implication: Treat every installed skill as an access-bearing component and map it to the permissions of the agent that loads it.

Why malicious skills are hard to spot by inspection alone

Malicious skills often hide inside ordinary operational instructions. A skill can present itself as a summariser, reviewer, or productivity helper while embedding directives to ignore guardrails, harvest workspace files, or route data externally. That pattern is dangerous because static name-based review does not reveal intent. The security issue is not only code quality, but instruction quality and execution context. In governance terms, this is a supply-chain trust problem for agent extensions: the artefact is lightweight, the publishing barrier is low, and the runtime consequence is high because the skill rides on the agent’s authority. Security teams need to inspect what the skill instructs the agent to do, not merely where the skill came from.

Practical implication: Review skill instructions for data exfiltration, guardrail bypass, and workspace harvesting before permitting execution.

Why real-time blocking matters for agent skill governance

A skill that is flagged after installation is already inside the control perimeter, which is why detection alone is not sufficient. Real-time enforcement changes the control from retrospective review to active prevention at the moment the agent tries to execute the skill. That matters because agent tasks are often continuous and distributed across endpoints, making delayed response too slow to protect credentials, files, and chat channels. The core mechanism is policy enforcement at invocation time, paired with logging that makes the block explainable to security teams. Without that timing, a malicious skill can complete the exfiltration or command sequence before anyone sees the alert.

Practical implication: Block suspicious skills at invocation time and log the reason so security teams can investigate without delay.

Threat narrative

Attacker objective: The attacker wants to use a trusted agent extension to harvest sensitive data and execute actions under legitimate-looking access.

1. Entry occurs when an employee installs a skill from an open ecosystem that looks like a normal productivity or engineering helper.
2. Credential and workspace access follow because the skill inherits the host agent’s permissions, including files, environment variables, and messaging channels.
3. Impact occurs when the malicious skill exfiltrates sensitive data or pushes unauthorized actions through trusted agent workflows.

NHI Mgmt Group analysis

Agent skills are becoming a governed identity surface, not just a software packaging format. The article shows that a skill inherits the permissions of the host agent, which means the control question is who or what is allowed to extend an agent’s authority. That moves skills into the same governance conversation as service accounts, tokens, and other non-human access objects. Practitioners should treat each skill as an identity-bearing extension of the agent runtime.

Skill publishing speed has outpaced enterprise trust validation. A 10x increase in publishing volume compresses review time and increases the chance that unsafe skills spread before they are understood. The interesting point is not adoption momentum alone, but the mismatch between rapid distribution and slow governance. The implication is that intake controls, inventory, and runtime enforcement now matter more than marketplace growth.

Malicious skills create an identity blast radius through the host agent. Once a skill can read files, use environment variables, and send messages, the compromise surface extends beyond the skill itself. This is not simply software supply chain risk. It is delegated privilege with weak provenance and strong downstream reach, which means teams need to understand where host-agent permissions become the real enforcement boundary.

Visibility is the named concept that separates manageable agent ecosystems from blind trust. The article makes clear that most teams do not know which skills are installed, let alone whether they are safe. That is a governance failure because inventory is the prerequisite for review, approval, and blocking. The practitioner conclusion is direct: without a live skill inventory, agent skill governance remains aspirational.

The agent skill supply chain exposes the same structural weakness seen in other dependency ecosystems, but with a higher operational blast radius. Traditional package risk usually starts with code execution. Here, execution arrives already wrapped in a trusted agent context that can touch credentials, files, and communications. That means the control model has to move from package trust to runtime authorisation and endpoint-level enforcement.

From our research library:

• Only 5.7% of organisations have full visibility into their service accounts, according to the Ultimate Guide to NHIs.
• Read next: AI Agent Authorisation Guide

What this signals

Visibility is now the first control, not an afterthought. Agent ecosystems move faster than manual review cycles, so the programme question is whether security teams can maintain a current inventory of installed skills, the endpoints they touch, and the permissions they inherit. Without that, review and blocking both arrive too late.

Agent skill governance belongs in the same control family as NHI oversight. A skill that inherits host-agent permissions behaves like a non-human access extension, which means lifecycle control, provenance, and runtime restriction matter more than adoption enthusiasm. The practical shift is from asking whether a skill is useful to asking whether it is governable.

For practitioners

• Build a live agent skill inventory Continuously enumerate every skill installed across employee endpoints, including who installed it, when it appeared, and which agent platform loaded it.
• Review skill instructions before execution Inspect SKILL.md contents for guardrail bypasses, workspace harvesting, and external data routing before allowing the skill to run.
• Restrict agent host permissions Reduce the file, shell, secret, and messaging permissions available to the host agent so a compromised skill inherits less authority.
• Block risky skills in real time Enforce policy at invocation time so a flagged skill cannot execute commands or exfiltrate data before the alert is reviewed.
• Log skill provenance and enforcement decisions Keep a record of installation source, endpoint, decision outcome, and the exact reason a skill was allowed or blocked.

Key takeaways

• Agent skills extend the authority of the host agent, which turns employee-installed helpers into governed access objects rather than harmless add-ons.
• The article ties rapid skill growth to a malicious distribution campaign, showing that scale and abuse are arriving together, not sequentially.
• Security teams need inventory, instruction review, and real-time blocking to keep agent skills from becoming an untracked data and command channel.

Key terms

• Agent Skill: A reusable package of task-specific knowledge and procedures that an autonomous agent can load when needed. In practice, it separates general awareness from operational detail, which makes enterprise context easier to govern than a single oversized prompt.
• Skill Supply Chain: The ecosystem of external task bundles, plugins, scripts, and dependencies that extend an agent’s capability. Because these artifacts can carry hidden instructions or vulnerable code, they must be reviewed as executable supply chain inputs rather than harmless configuration.
• Privilege Inheritance: Privilege inheritance occurs when a system uses the permissions of the human or service identity that launched it. For agents, this means the workload can access anything the parent role can access, which makes entitlement design more important than the model’s natural-language capabilities.
• Runtime Guardrail: A control applied while an AI agent is operating, not just during configuration or review. Guardrails can block dangerous tool calls, require approval for sensitive actions, or stop data leakage before it reaches systems or users.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are responsible for identity security strategy or NHI governance in your organisation, it is worth exploring.