AI agent skills create a new governance gap in modular workflows

At a glance

What this is: This is an analysis of AI agent Skills as modular workflow packages, with the central finding that their reuse and high-priority execution model create a new governance gap.

Why it matters: IAM, PAM, and NHI teams need to govern Skills because they move trust from one-off prompts to reusable artefacts that can carry privileged behaviour across tools and workflows.

Context

AI agent Skills are reusable instruction packages that let an agent load task-specific guidance, scripts, and standards when a workflow needs them. The governance problem is that this modularity shifts control from the prompt itself to the artefact that defines behaviour and tool use.

For identity and access teams, the question is not whether a Skill is convenient, but how its instructions, scripts, and permissions are reviewed, scoped, and retired. Once Skills can shape tool execution across multiple platforms, lifecycle governance becomes part of AI agent identity security.

Key questions

Q: What breaks when AI agent access decisions are handled in prompts?

A: Prompt-based access control is fragile because it places security logic inside the same system attackers are trying to influence. That makes policy easier to manipulate than an external authorization layer. When the model owns the decision path, organisations lose a clear boundary for audit, enforcement, and separation of duties.

Q: Why do AI agent skills create more risk than ordinary software packages?

A: AI agent skills inherit the permissions of the agent that runs them, so a malicious skill can act inside an existing trust boundary without needing to steal credentials first. That makes the effective blast radius depend on the agent's roles, tokens, and service connections, which is why skill governance must be tied to identity scope.

Q: How should teams govern AI agent skills in production?

A: Treat skills as controlled runtime assets, not informal text. Assign ownership, version them, restrict when they can load, and require evaluation before release. The right question is whether a skill improves a specific model-harness pair under real task conditions, because that is where hidden regressions and overbroad instructions show up.

Q: When do AI agent Skills become an offboarding problem?

A: They become an offboarding problem as soon as a Skill is no longer in active use but remains installed in a project, personal workspace, or system-level automation path. At that point, the package still represents residual behaviour and possible tool access, even if nobody believes it is operational anymore.

Technical breakdown

How AI agent Skills change the trust boundary

A Skill is not just documentation. In this model it is a portable package, usually a folder with SKILL.md plus optional scripts and templates, that an agent loads when a task matches the Skill’s purpose. That means the trust boundary shifts from the user prompt to the Skill artefact itself. When Skills can inject instructions into the system prompt and trigger helper code, the agent is effectively inheriting behavioural and operational authority from the package. That is why this model needs governance similar to privileged tooling, not just prompt hygiene.

Practical implication: review Skills as governed execution artefacts, not as static text files.

Why dynamic Skills expand the attack surface

Static Skills only influence the agent through instructions. Dynamic Skills go further by allowing the agent to decide when to execute scripts and feed results back into reasoning. That introduces a second trust layer: the instructions may be benign, while the helper code performs actions the user did not explicitly inspect. In security terms, the risk is not simply prompt injection. It is delegated execution through a package that can browse, load, and use tooling with the agent’s permissions. That creates a broader control problem around provenance, package integrity, and tool invocation scope.

Practical implication: treat helper scripts inside Skills as privileged code paths that require integrity checks and review.

Where modular workflows create governance drift

Modular workflows are attractive because they are reusable across teams, but reuse also obscures ownership. A Skill can be copied into a project, a personal workspace, or a system-level automation path, while the original author, reviewer, and operator become separated over time. That is a classic lifecycle problem. The governance gap appears when no one can say who approved the current Skill version, who last reviewed its tool access, or when it should be removed. In practice, modularity without ownership controls turns convenience into residual privilege.

Practical implication: enforce ownership, review, and retirement rules for every Skill location and version.

Threat narrative

Attacker objective: The objective is to hijack agent behaviour through a trusted Skill package and use that delegated execution path to steal data or run malicious actions.

1. Entry occurs when an attacker introduces or replaces a Skill package through a shared registry, workspace, or copied folder.
2. Credential or command access follows when the Skill’s instructions or helper scripts run with the agent’s available filesystem, network, or shell permissions.
3. Impact occurs when the agent follows malicious instructions, exposing secrets, executing unintended commands, or abusing trusted tool integrations.

Breaches seen in the wild

• AI agent retail card theft campaign 2026: AI agents breached 27+ retailers for about $25 each, used cloud keys and a Secrets Manager dump, and stole 600,000+ payment cards.
• CoPhish OAuth phishing via Copilot Studio: Datadog showed Copilot Studio agents on a Microsoft domain can front OAuth consent phishing and forward stolen tokens; no victims reported.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Skills governance is really lifecycle governance for AI agent behaviour. The article shows that the operational unit of control is no longer the prompt, but the reusable Skill package that can persist across projects, tools, and teams. Once a Skill can carry instructions, scripts, and tool selection into runtime, the governance problem becomes who owns it, who approved it, and when it expires.

Prompt injection by design is the wrong abstraction for the core risk. The deeper issue is that a Skill can become a high-priority behavioural container that an agent loads on demand, often with broad permissions. That means the control gap is not only malicious content, but ungoverned execution authority embedded in a portable artefact. Practitioners should recognise this as an NHI lifecycle failure mode, not just content moderation.

Skill reuse creates identity blast radius across multiple platforms. The same package can be deployed across Claude Code, GitHub Copilot, VS Code, and custom agents, which means one weakly governed artefact can influence many execution environments. That broad reuse is what makes provenance, signing, and revocation central to agentic identity security. The practitioner takeaway is that cross-platform portability increases the consequences of a single governance miss.

Agentic workflows now expose a new trust debt: reusable instructions with delegated execution. The article’s distinction between static and dynamic Skills shows why simple prompt rules are not enough once scripts and external APIs enter the flow. Governance teams need to treat the Skill catalogue as a managed identity surface, where access scope, helper code, and retirement state all matter at once.

Modular workflow standards will push security teams toward artefact-level controls, not just policy-level controls. The more the ecosystem normalises Skills as the unit of reusable capability, the more organisations will need to inspect what each Skill can do, not only what it says. That moves the field toward stronger provenance, review, and offboarding discipline for AI agent workloads.

From our research library:

• 88% of organisations have embedded AI agents in their workflows, according to KPMG's 2026 report.
• Read next: AI Agent Identity Security Buyer's Guide

What this signals

Skill packages create a new managed surface for agent governance: once behaviour is modularised into reusable files, lifecycle control has to follow the package, not the prompt. That means approval, provenance, and retirement need to be tracked the same way teams track privileged non-human access.

Cross-platform reuse increases identity blast radius: a single Skill can influence multiple agents and environments, so weak review on one artefact can scale across an entire workflow estate. Teams should expect the governance model for AI agent Skills to converge on artefact inventory, ownership, and revocation discipline.

The control question is no longer whether an agent can use tools, but whether the reusable package that authorises that behaviour is still trusted. That is a different governance problem from prompt engineering, and it belongs in the identity programme rather than in ad hoc AI experimentation.

For practitioners

• Review Skills as governed artefacts Inventory every Skill repository, project folder, and system-level location, then assign explicit ownership for approval, updates, and removal.
• Separate text instructions from executable helpers Classify any Skill that ships scripts, API calls, or shell actions as a higher-risk package and require code review before activation.
• Restrict privileged tool access by Skill scope Limit filesystem, network, and shell permissions to the minimum needed for each reusable workflow package, especially where Skills can trigger external APIs.
• Track provenance and version history for every Skill Require a change record for each Skill update so teams can trace who modified instructions, helper files, and tool references before deployment.
• Retire stale Skills on a defined schedule Remove unused or duplicated Skills from personal, project, and system-level stores before they accumulate residual access and undocumented behaviour.

Key takeaways

• AI agent Skills turn reusable workflow instructions into governed execution artefacts, which changes where trust has to be controlled.
• Dynamic Skills are riskier than static ones because they can combine instructions with script execution and tool use under the agent’s permissions.
• The governance response is lifecycle discipline for Skills, including ownership, provenance, scope review, and retirement.

Key terms

• Agent Skill: A reusable package of task-specific knowledge and procedures that an autonomous agent can load when needed. In practice, it separates general awareness from operational detail, which makes enterprise context easier to govern than a single oversized prompt.
• Dynamic Skill: An AI agent Skill that can reference scripts or external actions and let the agent decide when to use them. This matters because the risk moves beyond text governance into executable behaviour, requiring review of both instructions and helper code.
• Skill provenance: The evidence trail showing where an agent skill came from, who published it, what changed, and whether it has been signed or verified. Provenance is the control that helps security teams separate trusted capabilities from impersonation, tampering, and supply chain compromise.
• Prompt Injection by Design: A failure mode where instructions that were meant to guide an AI system can be abused to override or redirect behaviour during execution. In agentic workflows, the risk becomes operational when the injected content can influence tool choice, command use, or access to sensitive data.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.