AI agent skills turn plain English into a new attack surface

At a glance

What this is: This is an analysis of how AI agent skills expand the attack surface by letting plain-language instructions and bundled scripts steer agent behaviour, with public skill ecosystems already showing malicious skills, hidden backdoors, and credential theft.

Why it matters: It matters because IAM, PAM, and NHI controls were built to govern executable access and code, not instruction layers that agents load and follow as context, which changes how teams inventory, review, and constrain agent capabilities.

By the numbers:

• According to OWASP, the AI agent skill ecosystem is under active attack as of Q1 2026.
• ClawHavoc flooded ClawHub with 341 malicious skills between January 27 and 31.
• Snyk scanned 3,984 skills from ClawHub and skills.sh and found that 13.4% contained at least one critical-severity issue.

👉 Read Noma Security's analysis of AI agent skill risks and instruction-layer attacks

Context

AI agent skills are small instruction packages that agents load into context and follow, which makes the instruction layer part of the control plane rather than mere documentation. In practice, that means a markdown file, bundled script, or hidden character sequence can influence what an agent does, what tools it uses, and where data flows next. For teams already tracking NHI sprawl, this extends the attack surface from credentials and code into natural language.

The governance gap is familiar even if the medium is new. Security teams know how to review software packages, but they do not yet have mature controls for reviewing instructions that can be interpreted by an agent with inherited permissions. That is why skill inventory, provenance, version pinning, and runtime isolation matter as much here as code scanning.

For readers already building AI agent programmes, the key question is not whether skills are useful. It is whether the organisation can distinguish vetted instructions from hostile ones once the agent has loaded them, and whether existing NHI governance can still limit blast radius when the skill layer is compromised.

Key questions

Q: How should security teams govern agentic AI as it moves into production?

A: Security teams should govern agentic AI as a class of non-human identity, not as a generic application feature. That means assigning ownership, scoping permissions tightly, logging every tool action, and revoking access on a defined lifecycle. Production rollout should require clear approval points for high-risk actions and continuous monitoring for drift.

Q: Why are browser extensions a problem for IAM and NHI teams?

A: Because extensions can operate inside authenticated sessions and reach cookies, tokens, and page data that IAM may not directly see. That creates a blind spot where a user remains properly authenticated while the extension acts as a hidden access path. NHI teams should treat this as session abuse risk, not only endpoint risk.

Q: What do security teams get wrong about reviewing community AI agent skills?

A: They often review the visible text and forget that the agent reads raw content, not a rendered browser view. Hidden Unicode, bundled scripts, and silent network calls can all survive casual inspection. A safe review process needs raw-file analysis, malware scanning, and explicit approval for updates after the first install.

Q: What is the difference between securing the model and securing the skill layer?

A: Securing the model focuses on the AI system itself, while securing the skill layer focuses on the instructions and assets the agent loads at runtime. The model can behave correctly and still be steered into unsafe actions by a malicious skill. Practitioners need both model governance and instruction-layer governance for meaningful control.

Technical breakdown

Why AI agent skills are more than documentation

A skill is not a passive document once an agent loads it into context. It becomes operational guidance that the model follows alongside system prompts and tool permissions, which means the instruction can shape both reasoning and action. Because the agent cannot reliably tell benign internal guidance from malicious text, a harmful SKILL.md can redirect a legitimate workflow without needing to compromise the model itself. Bundled scripts make the problem harder: they execute under the agent's existing permissions, so the skill inherits filesystem, API, and network reach already granted to the agent.

Practical implication: treat skills as executable governance objects, not documentation, and subject them to the same approval discipline as code and secrets.

Hidden Unicode and prompt injection in the skill layer

The article highlights two distinct instruction-layer techniques. First, hidden Unicode characters can embed instructions that render invisibly to humans but remain readable to the agent. Second, prompt injection can be placed directly in the skill text or bundled assets to cause unsafe tool use or safety bypass. These are control-plane failures because the malicious instruction is consumed at runtime, after review, by the same decision system that executes legitimate tasks. Traditional static scanners are weak here because they are built to recognise code signatures, not meaning in natural language.

Practical implication: inspect the raw source, not only the rendered file, and add content-aware review steps for language-based instructions.

Why sandboxing and permission scoping matter for skills

Skills inherit the reach of the agent runtime unless the environment constrains it. If one process can see broad file paths, credentials, and network egress, then any skill loaded into that process can potentially read or exfiltrate those assets. That is why container isolation, restricted file-system access, and explicit egress controls are the real containment layer for skills. Least privilege also needs to move from the agent level to the credential level, so a skill that only formats documents cannot touch administrator tokens or high-value APIs. In NHI terms, this is blast-radius reduction for delegated machine access.

Practical implication: run agents in sandboxes and scope credentials per task so a malicious skill cannot inherit unrestricted access.

Threat narrative

Attacker objective: The attacker wants to use trusted-looking agent instructions to steal credentials, exfiltrate data, or manipulate agent actions from inside the authorised workflow.

1. Entry occurs when a malicious or backdoored skill is installed from a public marketplace or pulled into an agent environment without sufficient review. Escalation follows when the agent loads the SKILL.md instructions and bundled scripts into context, giving the attacker control over task execution without touching the model itself. Impact occurs when the skill harvests secrets, exfiltrates data, or routes the agent into unsafe actions while the workflow appears normal to human reviewers.

Breaches seen in the wild

• Moltbook AI agent keys breach — Moltbook breach exposed 1.5M AI agent keys.
• Meta AI Instagram Account Takeover — 20,225 Instagram accounts hijacked via compromised Meta AI support chatbot with overprivileged access.

Read our 52 NHI Breaches Analysis report for a comprehensive view of breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Plain English has become part of the control plane. That is the central governance shift in this article, and it should change how identity teams classify risk. A skill is not just content when an agent loads it into context and acts on it; it is an instruction-bearing object with delegated authority. That moves skills into the same governance conversation as secrets, tokens, and service accounts because the behaviour change happens at runtime, not at authoring time.

Skill provenance is the new trust boundary for agentic systems. The article shows that marketplaces can distribute harmful instructions faster than governance workflows can inspect them. When the agent consumes the skill directly, the human approval moment has already passed, so the real control boundary becomes source, version, and runtime isolation. Practitioners should treat unsigned or unvetted skills as untrusted inputs, not as benign productivity accelerators.

Identity governance for AI agents must extend to the instruction layer. NHI programmes often focus on credential rotation and vaulting, but the article shows that access can be abused without stealing the credential at all. If a skill can direct an agent with valid access to do harmful things, the failure is not only credential exposure, it is delegated instruction abuse. That means the governance model has to account for what the agent is told to do, not only what it is allowed to reach.

Instruction-layer compromise creates a distinct supply chain problem. Traditional software supply chain controls are necessary but insufficient because they were designed to inspect packages and executables, not natural-language directives that agents interpret as operating instructions. The named concept here is the instruction-layer attack surface: a trust gap created when human-readable guidance becomes machine-enforced behaviour. Practitioners should recognise this as a separate control domain, not as a variant of code scanning.

Blast radius depends on inherited permissions, not skill intent. A benign-looking skill can only become dangerous if the agent runtime already has enough privilege to make the malicious instructions effective. That is why permissions, network egress, and filesystem reach matter more here than whether the skill appears useful. The governance implication is simple: if the runtime is broadly trusted, the skill marketplace becomes a direct path to compromise.

From our research:

• 80% of organisations report their AI agents have already performed actions beyond their intended scope, including accessing unauthorised systems (39%), inappropriately sharing sensitive data (31%), and revealing access credentials (23%), according to AI Agents: The New Attack Surface report.
• Only 52% of companies can track and audit the data their AI agents access, leaving 48% with a complete blind spot for compliance and breach investigation.
• That visibility gap is why practitioners should also review OWASP NHI Top 10 alongside their agent governance programme.

What this signals

Instruction-layer attack surface: when agent skills can change behaviour after approval, the governance problem is no longer limited to credential issuance or model safety. Teams need to watch for the point where runtime instructions become more privileged than the review process that signed off on them. That shift will expose weak ownership, weak provenance, and weak runtime isolation in the same control path.

The practical signal is that agent programmes will need a continuous intake process for skills, including source verification, sandbox policy, and change review. With 80% of organisations already reporting AI agents acting beyond intended scope, per AI Agents: The New Attack Surface report, the question is no longer whether control gaps exist. It is whether the organisation can find them before the next skill update lands.

As the ecosystem matures, the best teams will treat agent instructions like a governed supply chain rather than a shared knowledge base. That means linking agent runtime policy to OWASP Agentic AI Top 10 principles and proving that every skill has an accountable owner before it is allowed into production.

For practitioners

• Inventory all installed skills Build a complete register of every skill deployed across agent environments, including source, version, owner, and last review date. You cannot govern skill risk without knowing what is actually loaded into production agents.
• Review raw SKILL.md files before approval Inspect the raw source rather than only the rendered marketplace view or pull request display. That is where hidden Unicode, prompt injection, and other non-obvious instruction tricks are most likely to hide.
• Sandbox agent runtimes by default Run agents in isolated containers or similarly constrained environments, with restricted file-system paths and explicit network egress controls. This reduces the blast radius when a skill turns out to be hostile.
• Scope credentials per task and skill Do not let every skill inherit every credential the agent can reach. Separate high-value API keys, administrator access, and general-purpose task credentials so a single skill cannot pivot across the environment.
• Pin skill versions and reapprove updates Treat skill updates like package updates, not content edits. A skill that was reviewed at installation can become unsafe after an author pushes a new version, so version pinning and update review are required controls.

Key takeaways

• AI agent skills turn natural language into an operational trust boundary, which means governance must cover instructions, not just credentials and code.
• Public marketplaces already show real exposure, with malicious skills, hidden backdoors, and exfiltration techniques reaching production-like environments.
• Practitioners need inventory, raw-source review, sandboxing, and version pinning to keep agent skills from becoming a delegated access path for attackers.

Key terms

• Skill: A skill is a modular instruction package that teaches an agent how to perform a task at runtime. It can include a markdown instruction file, metadata, scripts, and supporting documents. In agentic environments, a skill is not passive documentation. It is an active control input that can shape behaviour, tool use, and execution.
• Instruction-layer attack surface: The instruction-layer attack surface is the risk created when natural-language guidance becomes machine-followed behaviour. For AI agents, this includes SKILL.md files, hidden instructions, and embedded prompts that can redirect authorised activity without compromising the underlying model or stealing a credential.
• Inherited Permissions: Inherited permissions are access rights passed from the authorizing user or application to a connected integration. They become risky when the granted scope is broader than the integration needs, because the downstream app can retain high privilege long after the original business need has changed.

What's in the full article

Noma Security's full blog post covers the operational detail this post intentionally leaves for the source:

• The article's examples of malicious skill distribution and marketplace abuse across public ecosystems.
• The specific skill-layer attack patterns, including hidden Unicode and silent exfiltration mechanics.
• The practical review workflow for raw SKILL.md files and bundled scripts before installation.
• The source's discussion of OWASP's Agentic Skills Top 10 and related ecosystem guidance.

👉 The full Noma Security post covers hidden Unicode backdoors, marketplace abuse, and the control implications for agent runtimes.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity security are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM or identity security programme, it is worth exploring.