Agent skills need governance before malicious skills spread

At a glance

What this is: This is Akto's product update on governing agent skills, with a central finding that skill publishing accelerated 10x while malicious skills were already appearing in the wild.

Why it matters: It matters because agent skills inherit the permissions of the AI agent they extend, which turns a governance blind spot into direct exposure across NHI and emerging agentic AI programmes.

By the numbers:

• The agent skill publishing rate went up from under 50 in mid-January to over 500 by early February, a 10x increase in weeks.
• When AWS credentials are exposed publicly, attackers attempt access within an average of 17 minutes.
• 72% of organisations have experienced or suspect they have experienced a breach of non-human identities, with 46% confirmed and 26% suspected.

👉 Read Akto's update on detecting and governing agent skills in Akto Atlas

Context

Agent skills are modular instruction sets that let an AI agent perform a task with additional domain context, scripts, and workflow logic. In identity terms, they matter because the skill inherits the permissions of the host agent, so a bad skill can become a route into data, tools, and communications the agent can already reach.

The governance gap is simple: most teams can describe the agent but cannot inventory the skills installed on employee endpoints. That leaves security programmes blind to an expanding layer of non-human access that now influences both agentic AI behaviour and traditional identity control boundaries.

Akto's update argues that the control problem is not whether agents will be used. It is whether organisations can see which skills are present, understand what they can do, and stop malicious instructions before they execute. That starting position is becoming typical rather than exceptional.

Key questions

Q: How should security teams govern portable agent skills across multiple platforms?

A: Use a single trust policy for provenance, signing, version pinning, and revocation across every platform that can load the skill. If a skill behaves differently by platform, treat that as a control failure, not a convenience feature. The goal is to make trust portable only when governance is portable too.

Q: Why do malicious skills create a bigger risk than ordinary code dependencies?

A: Malicious skills can influence what an agent does after load time, including tool selection, command execution, and data handling. Ordinary dependencies usually expose code paths, but skills can alter behaviour through instructions that look normal to a human reviewer. That makes them harder to spot and easier to operationalise at scale.

Q: What do teams get wrong about agent skill visibility?

A: They often assume platform adoption equals governance coverage. In reality, employees can install skills faster than security teams can review them, and many skills are designed to look benign. Without continuous inventory and instruction scanning, organisations do not know which skills are present, what they can access, or when they should be removed.

Q: Who is accountable when a malicious agent skill causes data loss?

A: Accountability sits with the organisation that allowed the skill to execute under a trusted agent's authority. That means ownership must span endpoint management, identity governance, and security operations. If no team owns install approval, review, and revocation, the accountability gap becomes part of the breach path.

Technical breakdown

Agent skills as privileged extensions

Agent skills are structured folders containing instructions, scripts, and resources that an AI agent can load at runtime. They are not merely documentation. They extend the host agent's effective permissions, so a skill can inherit shell access, file-system access, and access to environment variables or messaging channels. In identity terms, the skill becomes part of the agent's operational trust surface. That is why a malicious skill is dangerous even when its files look harmless. The risk is not just code execution, but delegated execution under the agent's authority.

Practical implication: treat each skill as an identity-bearing extension and inventory it alongside other non-human access paths.

Why malicious instructions are hard to spot

A malicious skill often hides in plain sight inside a SKILL.md file that appears to support productivity, code review, or meeting analysis. The dangerous part is usually instruction content, not a binary payload. A skill can tell an agent to ignore guardrails, scrape workspace files, or route data to an external endpoint while preserving a useful-looking front end. This is a governance problem because static package review does not reliably reveal runtime intent. Security teams need to inspect the instructions the agent will follow, not only the source package name.

Practical implication: scan skill instructions for data-exfiltration language, override commands, and hidden destination endpoints.

Real-time guardrails for agent skill execution

The article describes a control pattern where detected skills are continuously scanned, flagged, and blocked before execution if they are malicious. That model is closer to runtime authorisation than to software catalogue management. The key mechanism is immediate enforcement when a new skill appears, paired with logging that explains what was blocked and why. In practice, this matters because the exposure window for malicious non-human identity tooling is short. Once an employee installs a dangerous skill, delay becomes the failure mode.

Practical implication: enforce runtime blocking for high-risk skills rather than relying on after-the-fact review.

Threat narrative

Attacker objective: The attacker wants to turn a trusted agent extension into a data-exfiltration and command-execution path inside the employee environment.

1. Entry occurs when an employee installs a skill that looks like a productivity or engineering helper but contains malicious instructions or hidden exfiltration logic.
2. Credential and data access follow because the skill inherits the agent's permissions, including access to files, environment variables, and messaging channels.
3. Impact occurs when the agent executes the skill's instructions, exposing data or enabling unauthorized commands under trusted agent authority.

Breaches seen in the wild

• Meta AI Instagram Account Takeover — 20,225 Instagram accounts hijacked via compromised Meta AI support chatbot with overprivileged access.
• Replit AI Tool Database Deletion — Replit vibe coding AI assistant deletes live production database and creates 4,000 fake user records.

Read our 52 NHI Breaches Analysis report for a comprehensive view of breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Agent skills create a new privileged extension layer, not just another software package class. The security question is not whether the file is code, but whether the agent will execute it with inherited authority across tools and data sources. That shifts the control boundary from package reputation to runtime identity governance. Practitioners should treat skills as part of the agent's access fabric, not its app layer.

Skill sprawl is becoming the agentic equivalent of NHI sprawl. Publishing rates rising from under 50 to over 500 in a few weeks shows that the ecosystem can expand faster than manual review can keep up. The named concept here is agent skill trust debt: every unreviewed skill adds future governance cost because its permissions, behavior, and provenance are all moving targets. The implication is that inventory alone is not enough unless it is tied to enforcement.

Visibility gaps, not just malicious code, are the real control failure. The vendor's own framing points to a simple truth: if security teams do not know which skills are installed, they cannot certify, revoke, or scope them. That is a governance assumption built for slower change cycles and breaks as soon as employees can add agent skills in minutes. Practitioners need to rethink how they define authoritative access state for agent extensions.

This is where agentic AI and NHI governance converge. Agent skills are not autonomous actors by the strict definition here, but they are non-human identities with delegated power that can change agent behavior at runtime. That means the same disciplines used for NHI lifecycle, privilege scoping, and offboarding now apply to agent extensions. The field will increasingly evaluate agent security through identity controls, not only model safety.

From our research:

• 72% of organisations have experienced or suspect they have experienced a breach of non-human identities, with 46% confirmed and 26% suspected, according to The 2024 ESG Report: Managing Non-Human Identities.
• From our research: Enterprises that have experienced a compromised NHI averaged 2.7 separate incidents in the past 12 months, according to The 2024 ESG Report: Managing Non-Human Identities.
• From our research: Read The 52 NHI breaches Report for case studies on how credential exposure and standing privilege turn into repeatable compromise patterns.

What this signals

Agent skill trust debt: security teams should expect the number of agent extensions to grow faster than human review cycles can absorb. That makes inventory quality and enforcement latency the two metrics that matter most, not the raw count of deployed agents.

With 72% of organisations already reporting or suspecting an NHI breach in recent research, the governance bar for agent skills is clearly structural, not optional. The practical next step is to align endpoint control, identity review, and runtime blocking before skills become a shadow AI problem.

Teams that already use the Ultimate Guide to NHIs , Key Challenges and Risks as a baseline should now extend the same governance logic to agent extensions and runtime instructions. The lesson is that agent security will increasingly be judged by who can install, execute, and revoke privileged skills.

For practitioners

• Inventory every installed agent skill Build a live inventory of skills across employee endpoints, agent platforms, and teams, and tie it to ownership, install time, and execution context. Visibility is the prerequisite control for revocation, review, and containment.
• Inspect skill instructions for hostile intent Scan SKILL.md content for data-exfiltration commands, guardrail bypass language, and hidden external destinations before a skill is allowed to run. Review the instruction layer, not just the package source.
• Block execution on high-risk skill indicators Move from alerting to enforcement so dangerous skills are prevented from running when they match malicious patterns or provenance rules. Real-time blocking matters more than retrospective cleanup once agents have access to credentials and messages.
• Map skill governance to NHI lifecycle controls Assign an owner, review cadence, and offboarding path for every skill that can influence a production agent. If a team can install a skill, it also needs a way to remove it and prove removal.

Key takeaways

• Agent skills turn AI extensions into privileged non-human identity surfaces, which means they belong in identity governance, not only endpoint tooling.
• Rapid skill publishing and malicious skill campaigns show that visibility gaps can become execution gaps in a matter of days, not quarters.
• Security teams need live inventory, instruction inspection, and runtime blocking before agent skill sprawl becomes the next repeatable breach pattern.

Key terms

• Agent Skill: A reusable package of task-specific knowledge and procedures that an autonomous agent can load when needed. In practice, it separates general awareness from operational detail, which makes enterprise context easier to govern than a single oversized prompt.
• Skill trust debt: Skill trust debt is the accumulation of operational dependence on third-party instruction packages before verification, signing, and isolation controls exist. It grows when teams value convenience and speed over governance. The more skills a programme adopts without review, the more difficult it becomes to distinguish useful automation from embedded abuse.
• Runtime Guardrail: A control applied while an AI agent is operating, not just during configuration or review. Guardrails can block dangerous tool calls, require approval for sensitive actions, or stop data leakage before it reaches systems or users.

What's in the full article

Akto's full product update covers the operational detail this post intentionally leaves for the source:

• How SkillGuard scans employee endpoints continuously to build a live inventory of installed agent skills.
• The specific guardrail logic used to flag malicious SKILL.md instructions and stop execution in real time.
• What the endpoint deployment model looks like when you want detection, enforcement, and logging in one workflow.
• Why OpenClaw and Claude Code are used as examples of the broader skills ecosystem rather than the whole risk surface.

👉 Akto's full post covers the live inventory model, malicious instruction detection, and real-time guardrail enforcement.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.