TL;DR: A public Claude Code skill attempted to collect a GitHub token by mixing frontmatter instructions with shell commands, and showed that commands can run before model refusal when dynamic context executes first, according to HikmaAI research. Model-level rejection is too late once skill preparation can read credentials and reach outbound endpoints.
At a glance
What this is: NHI Mgmt Group's analysis, drawing on HikmaAI's blog post: A Claude Code skill can execute token-reading commands before model refusal, turning skill loading itself into the security boundary.
Why it matters: This matters because AI coding-agent governance now has to cover pre-model execution, credential scope and host egress, not just what the model approves or rejects.
Context
A coding-agent skill is a package of instructions and executable steps that can run on the host as well as in the model context. That matters because the security decision is no longer limited to whether the model accepts a request; some commands may execute before the model sees the final text.
The governance gap is simple: teams often review an agent skill as if it were content, when parts of it behave like code. When those commands can read credentials or reach external endpoints, the security boundary shifts to the pre-model execution path.
AI IDE and coding agent security becomes relevant here because the risk is not only prompt injection but also host-level command execution inside an agent workflow.
Key questions
Q: How do coding-agent skills create token-exposure risk?
A: Coding-agent skills create token-exposure risk when they can execute shell commands, read local credentials and reach outbound endpoints before a model reviews the visible content. That turns a skill from a text package into an execution path. The practical control question is who can run, read and exfiltrate data during skill loading.
Q: Why do model refusals fail to stop malicious agent commands?
A: Model refusals fail because an agent can ignore or work around a model’s safety response by using other tools, alternate prompts, or hidden instructions in retrieved content. The real control is outside the model: constrain tool permissions, validate commands, isolate high-risk actions, and require human approval for privileged steps. Refusal messages are not an access-control mechanism.
Q: How should teams structure code review context for AI coding agents?
A: Teams should put the change intent, expected impact, and breaking behavior in the PR itself, not in side conversations or private knowledge. AI coding agents work best when they can read a concise summary first and then drill into linked issues, reviews, and test evidence only as needed.
Q: What is the difference between prompt injection and skill execution risk?
A: Prompt injection is malicious input that steers a model to produce unsafe instructions, while skill execution risk is the damage that occurs when an agent actually carries out a tool action, such as sending data or changing a record. The first targets model behaviour. The second targets delegated execution through APIs, scripts, and credentials. skill execution risk
Technical breakdown
Why dynamic context changes the control boundary
Dynamic context lets a skill package embed shell commands that run while the skill is being prepared, before the model evaluates the visible content. That means the security question is not just whether the agent refuses a malicious instruction, but whether the host will execute preparatory steps that can read files, spawn processes or make network requests. In practice, a skill file can carry both declarative guidance and executable behaviour, which makes it closer to code than to static policy. The control boundary therefore moves earlier in the workflow, to the point where the agent loads or preprocesses the skill. See the AI Coding Agents Security Guide.
Practical implication: Review skill files as executable artefacts and block any pre-model commands that can touch credentials or outbound destinations.
Why token access inside a skill is a credential-exposure problem
When a skill can run `gh auth token` or similar commands, it can request a live credential from the local environment rather than waiting for an explicit user action. That creates a credential-exposure path through the workstation, the agent runtime and any configured upload destination. The important issue is not the brand of token alone, but the fact that the agent workflow can combine credential read access with network egress in the same execution path. Once that combination exists, the skill is no longer just advisory text; it is a potential exfiltration mechanism. See the GitHub Personal Access Tokens Security Guide.
Practical implication: Limit which secrets the agent runtime can reach and treat token-read commands as high-risk execution paths.
Why model refusal is not a compensating control
A refusal by the model can stop a visible instruction, but it cannot undo commands that already executed during skill preparation. Datadog Security Labs' test showed that a modified skill could be rejected when the token request was visible, yet the dynamic-context path still allowed commands to run earlier. That distinction matters because many agent governance models assume the model is the final decision point. In this pattern, it is only one checkpoint, not the only one that matters. Read Delegation Chains and Attenuated Authority for AI Agents.
Practical implication: Move enforcement to host controls and pre-execution checks rather than relying on model refusal as the last line of defence.
Threat narrative
Attacker objective: The objective is to capture a valid developer GitHub token that can be reused for repository, workflow or supply-chain abuse.
- Entry occurs when a user loads a seemingly harmless coding-agent skill that contains hidden executable steps as well as instructions.
- Credential harvest is attempted when the skill invokes token-reading commands and prepares an outbound upload of the collected value.
- Impact is the potential exposure of developer credentials to an external endpoint before the model can block the request.
Breaches seen in the wild
- Anthropic GTG-1002 AI espionage campaign: A state-sponsored group ran Claude Code agents to attack about 30 organisations, harvesting and reusing credentials at machine speed.
- Trivy supply chain attack 2026: A PAT stolen via a Trivy workflow and a botched rotation let TeamPCP poison Trivy releases and Action tags to steal CI/CD secrets.
Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.
NHI Mgmt Group analysis
Skills have crossed from prompt content into executable supply-chain artefacts: The security question is no longer whether a model can spot malicious text, but whether a skill package can run code before the model ever evaluates the visible instructions. That changes review from content moderation to software-style inspection, with special attention to pre-model shell execution. Practitioners should treat agent skills as code paths with identity impact, not as documentation.
Model refusal is a useful signal, but it is not a sufficient control plane: Datadog Security Labs' test conditions show that visible malicious instructions may be refused while hidden preparatory commands still execute. The control failure is not only in the model, but in assuming the model is the enforcement point. Security teams need to decide whether the loading path, the host, or the agent runtime owns the real stop condition.
Pre-model execution collapses the trust gap between instruction and action: A skill that can read a credential and reach an upload endpoint has already become an execution environment. That is why least privilege, egress restriction and execution gating must be evaluated together instead of as separate hygiene tasks. The practical implication is that agent onboarding should include command-level inspection before any skill is admitted to use.
Credential theft from an agent skill is a governance problem, not just a prompt-injection problem: The hidden failure mode is broad shell permission combined with access to live developer secrets. That means the reviewer must ask what can run, what can be read, and where it can send data before the model sees anything. In NHIMG terms, the named concept here is pre-model execution exposure, the window in which an agent can act before model-level policy has a chance to intervene.
Host controls now define whether an agent skill is safe to load: The most important control is not the skill's wording but the workstation and runtime conditions under which it executes. If those conditions allow secret reads and outbound requests, the risk persists even when the model is cautious. Practitioners should govern skills as an end-to-end execution chain, from file inventory to network reachability.
From our research library:
- Claude Code-assisted commits leaked secrets at a rate of 3.2%, more than double the human-only baseline of 1.5%, with peaks reaching 31 secrets per 1,000 commits in August 2025, according to the State of Secrets Sprawl 2026.
- Read next: AI IDE and Coding Agent Security Guide
What this signals
Pre-model execution exposure: Agent governance now has to account for the window where a skill can act before the model evaluates it. That shifts the programme question from prompt safety to execution safety, with host permissions, command hooks and network reachability becoming first-class controls.
A secure agent programme should treat skill loading, credential access and outbound connectivity as a single enforcement domain. When those three are separated, a cautious model can still be bypassed by commands that already ran, which is why runtime monitoring and pre-execution policy must move together.
For practitioners
- Review skills as executable code Inspect frontmatter, shell steps and nested files before allowing any agent to load the skill. Treat a repository's skill files as part of the software you approve, not as harmless configuration.
- Block pre-model shell execution Disable or tightly constrain any command that runs during skill preparation, especially commands marked with `!` or equivalent pre-execution hooks.
- Limit token scope and egress paths Reduce which credentials the agent can reach and restrict outbound destinations from the host so an execution path cannot both read a token and upload it. See the GitHub Personal Access Tokens Security Guide.
- Monitor agent-started processes Watch for child processes, shell activity and network connections spawned during agent work, because those signals can appear before the model issues a refusal.
- Test one real skill end to end Pick a skill already in use, map every command that can run before model review, and verify which credentials and destinations each command can reach.
Key takeaways
- Coding-agent skills can behave like executable software, so their security profile extends beyond the text the model sees.
- The critical failure mode is the pre-model execution window, where shell commands can run before any refusal occurs.
- Host-level inspection, credential scoping and egress control are the controls that matter when skills can execute before model review.
Related NHI Mgmt Group resources: AI Coding Agents Security Guide · GitHub Personal Access Tokens Security Guide · Delegation Chains and Attenuated Authority for AI Agents
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Non-Human Identity Top 10, OWASP Agentic AI Top 10 and MITRE ATT&CK address the attack and risk surface, while NIST SP 800-53 Rev 5 and NIST CSF 2.0 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| OWASP Non-Human Identity Top 10 | NHI-02 — Secret Leakage | The skill attempts to read and upload a GitHub token, which is a secret leakage pattern. |
| Recommendation — Scan agent skill paths for secret reads and block any execution path that can exfiltrate credentials. | ||
| OWASP Agentic AI Top 10 | ASI02 — Tool Misuse | The skill uses command execution as a tool path to read and send credentials outside the intended task. |
| Recommendation — Restrict agent tools so skill execution cannot invoke commands that read or export secrets. | ||
| NIST SP 800-53 Rev 5 | IA-5 — Authenticator Management | The article centers on credential handling and exposure through a token read command. |
| Recommendation — Apply IA-5 to govern credential lifecycle, scope and revocation for agent-accessible tokens. | ||
| MITRE ATT&CK | TA0006;TA0010 — Credential Access; Exfiltration | The pattern combines token access with an attempted outbound upload of the stolen credential. |
| Recommendation — Map the workflow to credential access and exfiltration to drive detection and containment. | ||
| NIST CSF 2.0 | PR.AA-05 — Access Permissions, Entitlements and Authorizations | The risk depends on an agent runtime having more access than the task requires. |
| Recommendation — Constrain agent permissions so loaded skills cannot access credentials or destinations beyond task scope. | ||
Key terms
- Claude Code skill: A Claude Code skill is a packaged set of instructions and executable steps that extends an agent's behaviour in the terminal or development workflow. In security terms, it must be treated as code-bearing content because it can combine guidance, shell execution and credential access in one artefact.
- Dynamic context awareness: A detection approach that evaluates events against live organisational data at decision time rather than relying on static rules. It preserves telemetry while using current business state, such as travel, change tickets, or asset ownership, to decide whether activity is expected.
- GitHub Token: An automatic credential issued to GitHub Actions jobs for repository access. Its power depends on the workflow permissions granted to it, which is why write access in CI should be treated as exceptional. If an attacker reaches the runner, this token can be abused immediately.
- Shell Command Execution: Shell command execution is the running of operating system commands from a shell, script or application process. It can be invoked locally or remotely and often inherits the caller’s permissions, so unsafe input handling or over-privileged execution can lead to command injection or unintended system access.
Deepen your knowledge
NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are responsible for identity security strategy or NHI governance in your organisation, it is worth exploring.
Published by the NHIMG editorial team on November 9, 2026.
NHI Mgmt Group, the independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org