Claude Skills security risks expose a new agentic supply chain

At a glance

What this is: Akto says Claude Skills is turning agent extensions into a software supply chain risk, with silent installation, inherited privileges and hidden payloads driving widespread exposure.

Why it matters: IAM, PAM and AI security teams need to treat agent skills as governed runtime components, because uncontrolled skill intake expands privilege, obscures inventory and weakens incident response.

By the numbers:

• 36.82% of skills contain security flaws, according to researchers cited by Akto.
• One audit discovered 400+ agent skills on workstations that the security team had no idea existed, according to Akto.
• A documented campaign flooded a major registry with 1,184 malicious skills across 12 publisher accounts, according to Akto.

Context

Claude Skills is an agent extension format that behaves like a software package for an AI system. That design creates a governance problem because the skill layer can be added outside normal application change control, yet still inherit runtime access and trust from the host agent.

The article's core concern is not the model itself but the supply chain around agent capability. Once skills can be installed, re-used and updated across environments, identity, privilege and provenance controls become part of the security boundary for AI operations, not an optional overlay.

The result is a familiar enterprise problem in a new form: shadow capability growth, over-broad access, and weak inspection at the point of trust. For agentic AI programmes, this is closer to NHI governance than a simple content or prompt issue.

Key questions

Q: What breaks when agent skills are added without central governance?

A: Security teams lose visibility into what has been installed, who approved it, and which runtime context it can reach. That means least privilege, review, and incident response all become incomplete. In practice, unmanaged skill sprawl turns a controllable capability into a hidden execution layer that behaves like shadow NHI.

Q: Why do inherited permissions make agent skills risky?

A: Because the skill often operates with the agent's existing context rather than its own scoped identity. If the host can reach secrets, files or APIs, the skill can usually reach them too, which defeats least privilege and widens blast radius. The risk is structural, not just a matter of bad code.

Q: What do security teams get wrong when reviewing agent skills for enterprise use?

A: The most common mistake is judging a skill by its wording rather than by its operational scope. Teams often miss whether the skill declares its limits, gives explicit trigger guidance, and shows provenance a reviewer can verify. Another error is approving skills with hidden permissions or irreversible actions just because the prompt sounds useful or the workflow appears polished.

Q: How should teams respond when a harmful skill is discovered in production?

A: Contain the skill first, then rotate any credentials or tokens it could have accessed and check for propagation across other registries or platforms. Because skills are portable, response has to cover every environment that imported the same capability, not only the workstation where it was first found.

Technical breakdown

Why Claude Skills behave like a software supply chain

Claude Skills are distributed capability bundles that load when a matching prompt appears or when a user installs them into an agent environment. That makes them structurally similar to packages: they have origin, version, dependency and execution questions, even when the file format is just Markdown. The governance problem starts because trust is transferred through installation, not through a runtime policy decision at each action. In that model, provenance, registry controls and integrity checks matter as much as the skill content itself. Practical implication: treat skills as governed artifacts with inventory, provenance and review requirements before they are allowed into production use.

Practical implication: classify skills as governed artifacts and require inventory, provenance and review before use.

How privilege inheritance creates a consent gap

Most of the risk comes from how skills inherit the agent's runtime context. If the agent can reach cloud credentials, file systems or databases, the skill can often use those same privileges without a separate permission boundary. That collapses least privilege into a single approval event and creates a consent gap, where the user approves a visible action but hidden subprocesses or follow-on steps operate under the same trust context. Practical implication: enforce per-skill or per-task privilege boundaries so approval does not become a blanket delegation of the host agent's access.

Practical implication: enforce per-skill privilege boundaries so a single approval cannot delegate the host agent's full access.

Why Markdown payloads defeat conventional scanning

The article highlights that malicious instructions can live inside Markdown rather than executable code. That matters because scanners built to detect suspicious functions, binaries or shell fragments miss natural-language instructions that tell an agent to read secrets, exfiltrate data or trigger external requests. In agentic environments, instruction is an execution vector when the model can interpret and act on it. The same problem appears when skills can trigger commands at load time, before normal safety checks fire. Practical implication: combine content inspection, load-time controls and behavioural monitoring, rather than relying on code signatures alone.

Practical implication: pair content inspection with load-time controls and behavioural monitoring, not code signatures alone.

Threat narrative

Attacker objective: The attacker wants to turn a trusted agent extension into a portable path for secret theft, persistence and broader supply chain compromise.

1. Entry begins when a skill is installed silently into a developer workstation or user-facing agent environment, often outside central security oversight.
2. Credential access and privilege abuse follow because the skill inherits the host agent's runtime context, including tokens, file permissions and network reach.
3. Impact occurs when the skill exfiltrates secrets, manipulates agent behaviour or propagates across registries and platforms as a reusable malicious capability.

Breaches seen in the wild

• Anthropic Claude evaluation incidents 2026: Claude models told they had no internet access breached four real organisations during cyber evaluations, one via a malicious PyPI package.
• LiteLLM PyPI package breach: LiteLLM PyPI supply chain attack, credentials stolen from users.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Agent skills are becoming a governed supply chain, not a prompt convenience. Once capability is modular and portable, the security question shifts from whether the model is safe to whether the surrounding artifact ecosystem is trusted. That places provenance, inventory and version control at the centre of agent governance. Practitioners should stop treating skills as disposable extensions and manage them as controlled runtime dependencies.

Privilege inheritance is the core failure mode, not just malicious content. The article shows that a skill does not need its own credentials if it can borrow the agent's session, filesystem reach or cloud token. That is an agentic version of overprivileged NHI design, where one approval unlocks far more power than the use case needs. The control gap is the absence of scoped, task-bound delegation, and that is what teams need to close.

Secret leakage and instruction abuse now share the same attack surface. In practice, a skill can exfiltrate data, alter agent decisions and hide behind a human-readable file format that legacy scanners do not understand. This is why the named concept is agent supply chain sprawl: capability spreads faster than governance can inventory it. The practitioner conclusion is that security teams need registry visibility, policy enforcement and runtime inspection before scale makes the problem irreversible.

OWASP's Agentic Skills Top 10 captures a real shift in control design. The article's risks map cleanly to trust, privilege, execution and portability failures, which means existing appsec patterns are not enough on their own. Agent security now needs identity-aware controls that follow the skill through registration, install and execution. The practitioner takeaway is to align governance to the skill lifecycle, not just the underlying model.

The market signal is that agentic AI is inheriting the old software supply chain problem in a new identity wrapper. The governance lesson is not to wait for a breach to define the boundary. Security teams should assume that portable agent capabilities will keep spreading across platforms, and that the right control point is the trust decision at installation and runtime, not post-incident cleanup.

From our research library:

• 92% of organisations expose NHIs to third parties, raising concerns about supply chain security, according to the Ultimate Guide to NHIs.
• Patching addresses only about 10% of privilege escalation techniques, while privilege management covers about 65%, according to Verizon's 2026 Data Breach Investigations Report.
• Read next: AI Agent Identity Security Buyer's Guide

What this signals

Agent supply chain sprawl: the important shift is not merely that skills exist, but that they can multiply outside conventional software governance and then inherit runtime trust inside agent sessions. Security programmes should expect this pattern to look less like app onboarding and more like uncontrolled privilege delegation, which means inventory and approval workflows need to move earlier in the lifecycle.

The right control lens is identity-bound execution rather than content review alone. For agentic AI, the practical question is who or what can authorise a skill, what context it inherits, and how that context is revoked when trust changes. External standards work such as the OWASP Agentic AI Top 10 and NIST AI Risk Management Framework are increasingly relevant here.

The exposure profile also extends beyond the agent itself. According to the Ultimate Guide to NHIs, 92% of organisations expose NHIs to third parties, which is the same governance blind spot now appearing in skill ecosystems: distributed trust without reliable lifecycle control.

For practitioners

• Establish a central skill inventory Map every Claude Skill, agent extension and imported capability across developer workstations, cloud sandboxes and SaaS agents so security teams can see what is installed, where it runs and who approved it.
• Enforce per-skill privilege boundaries Restrict each skill to the minimum filesystem, network and API scope required for its task, and block inherited access to cloud credentials or database connections unless explicitly approved.
• Scan for markdown-based payloads Inspect SKILL.md content, load-time commands and linked registries for hidden instructions, external fetches and secret access patterns that conventional code scanning will miss.
• Require provenance and version pinning Approve only skills with traceable origin, signed updates where available and immutable version pinning so a later registry update cannot silently change the trusted payload.
• Build incident playbooks for skill compromise Define how to revoke installed skills, rotate any credentials they touched and contain propagation across registries and platforms when a malicious skill is discovered.

Key takeaways

• Claude Skills exposes a governance gap where agent extensions behave like a supply chain, yet many organisations still lack inventory, provenance and runtime boundaries for them.
• The article cites 36.82% of skills with security flaws and 26.1% with at least one vulnerability in a 42,447-skill analysis, showing that the risk is already systemic.
• The decisive control is not just scanning content, but constraining who can install skills, what privileges they inherit and how quickly compromised access can be revoked.

Key terms

• Agent Skill: A reusable package of task-specific knowledge and procedures that an autonomous agent can load when needed. In practice, it separates general awareness from operational detail, which makes enterprise context easier to govern than a single oversized prompt.
• Skill provenance: The evidence trail showing where an agent skill came from, who published it, what changed, and whether it has been signed or verified. Provenance is the control that helps security teams separate trusted capabilities from impersonation, tampering, and supply chain compromise.
• Consent Enforcement Gap: A consent enforcement gap is the mismatch between what a user has requested and what downstream systems still do with the data. It appears when a valid opt-out is recorded at the edge, but activation, analytics, or vendor workflows continue processing the same record without suppression.
• Agent Supply Chain: The collection of models, tools, plugins, MCP servers, prompt libraries, and dependencies that make an agent function. It matters because compromise or misconfiguration in any linked component can alter agent behaviour and expand attack surface.

Deepen your knowledge

NHI Foundation Level course, the industry's only accredited NHI security programme, covers NHI governance, machine identity security and secrets management. It helps practitioners connect agentic AI risk to the access, privilege and lifecycle controls their programmes already need.