Claude Skills security risks expose a new agentic supply chain

At a glance

What this is: This is an analysis of the security risks introduced by Claude Skills, with emphasis on supply chain poisoning, over-privileged execution, and agent hijacking.

Why it matters: It matters because agentic AI capabilities are becoming a new governance surface for IAM, NHI, and security teams that must control discovery, privilege, and provenance together.

By the numbers:

• 36.82% of skills contain security flaws.
• 26.1% carry at least one vulnerability.
• A documented campaign saw 1,184 malicious skills flood a major registry.

👉 Read Akto's analysis of Claude Skills security risks for agentic systems

Context

Claude Skills matters because it turns agent capability into a portable software supply chain, and that supply chain creates new trust assumptions around discovery, provenance, permissions, and runtime behaviour. In practice, the problem is not only that skills can be malicious. It is that they can be added quietly, inherited broadly, and executed with more privilege than most organisations realise.

For IAM and NHI practitioners, this is a governance problem with an identity dimension. A skill is not just code, it is a delegated capability that can interact with tokens, files, and APIs under an agent's runtime context. That makes skill governance part of the same control plane as secrets management, workload identity, and privileged access review. The starting position described in the article is increasingly typical, not exceptional.

Key questions

Q: What breaks when agent skills are added without central governance?

A: Security teams lose visibility into what has been installed, who approved it, and which runtime context it can reach. That means least privilege, review, and incident response all become incomplete. In practice, unmanaged skill sprawl turns a controllable capability into a hidden execution layer that behaves like shadow NHI.

Q: Why do agent skills increase privilege escalation risk in enterprise environments?

A: Because many skills inherit the agent's full runtime context, including credentials, file access, and network permissions. If the skill is not isolated, one approval can open multiple pathways to data theft or malicious action. The risk rises fastest when the agent already has access to secrets, repositories, or production APIs.

Q: What do security teams get wrong about reviewing community AI agent skills?

A: They often review the visible text and forget that the agent reads raw content, not a rendered browser view. Hidden Unicode, bundled scripts, and silent network calls can all survive casual inspection. A safe review process needs raw-file analysis, malware scanning, and explicit approval for updates after the first install.

Q: How should security teams govern portable agent skills across multiple platforms?

A: Use a single trust policy for provenance, signing, version pinning, and revocation across every platform that can load the skill. If a skill behaves differently by platform, treat that as a control failure, not a convenience feature. The goal is to make trust portable only when governance is portable too.

Technical breakdown

Ungoverned skill sprawl and discovery gaps

Claude Skills are installed into local directories or added through cloud interfaces, then loaded on demand when the model detects a matching prompt. That makes discovery hard because the control point is not a central application catalogue. It is distributed across workstations, accounts, and agent runtimes. If a skill registry is absent, security teams lose the ability to inventory what is present, who added it, and whether it is still in use. In identity terms, that means the organisation cannot reliably answer what has been delegated to which agent context.

Practical implication: build a discoverable inventory of all agent skills before trying to enforce policy.

Supply chain poisoning in agent skill registries

Agent skill registries resemble early package ecosystems: open submission, weak vetting, and limited provenance. The risk is not only a malicious file, but also a trusted repository path that delivers altered instructions or helper content. Because SKILL.md is plain text, traditional executable scanning misses much of the threat surface. Provenance, signing, and repository trust become the decisive controls, especially where skills can reference external content or trigger downstream actions without a human noticing every step.

Practical implication: treat skill provenance and source trust as mandatory controls, not optional review steps.

Over-privileged execution and the consent gap

Once approved, a skill can operate with the same runtime context as the agent itself, including tokens, network access, and file permissions. That creates a consent gap: the user approves a visible skill, but hidden helper functions or chained actions may execute under the same trust boundary. In NHI terms, this is delegated access without fine-grained scoping. The real failure is not merely excess privilege, but the absence of per-skill permission boundaries and environment-level containment.

Practical implication: scope agent permissions per task and contain skill execution in sandboxes with explicit egress limits.

Threat narrative

Attacker objective: The attacker aims to turn a trusted AI capability into a reusable access path for credential theft, data exfiltration, or agent-controlled malicious actions.

1. Entry occurs when a skill is installed from an open registry, a local directory, or a trusted-looking repository path without strong provenance checks.
2. Credential access follows when the skill inherits the agent's runtime context and can read tokens, files, or environment secrets under the same trust boundary.
3. Escalation and impact occur when the skill chains hidden actions, exfiltrates data, or hijacks the agent's behaviour across platforms that reuse the same SKILL.md file.

NHI Mgmt Group analysis

Agent skills are becoming a shadow NHI layer: a skill is effectively a delegated capability that can operate with access to tokens, files, APIs, and network paths. That makes it closer to a non-human identity than a simple plugin. Organisations that manage agents as software but ignore their delegated authority will miss the real governance boundary. Practitioners should treat skills as identities with scope, provenance, and lifecycle controls, not as harmless add-ons.

Skill sprawl creates identity governance debt: the central problem is not just that skills exist, but that most environments cannot reliably enumerate them, assign ownership, or revoke them cleanly. That mirrors the same pattern seen in unmanaged service accounts and orphaned secrets, only now the attack surface is embedded in agent workflows. This is where OWASP NHI Top 10 thinking and agentic AI controls intersect. Practitioners should prioritise inventory before policy, because control cannot follow invisibility.

Consent is not containment: approving a skill does not mean the resulting runtime behaviour is bounded to that approval. Once a skill inherits the agent context, hidden helper functions and remote content can extend execution beyond what the user saw. That is a governance failure, not just a technical defect. Security teams should assume that any agentic workflow without per-skill boundaries has already collapsed least privilege at design time.

The named concept here is agentic supply chain exposure: once skills are portable across platforms, the compromise path travels with the file, not just the registry. That weakens platform-specific assumptions about trust and makes provenance more important than location. In practice, practitioners need controls that follow the skill across environments, including signing, version pinning, and platform-aware trust policies.

OWASP AST10-style portability risks change the blast radius of compromise: a skill that looks safe in one environment may propagate into another where permissions and metadata differ. That means cross-platform indexing can amplify a single malicious update into a multi-tool incident. Security leaders should align agent governance with supply chain controls already used for software artefacts, because agent skills now behave like reusable execution packages.

What this signals

Agentic supply chain exposure should now be treated as a programme-level control domain, not a niche AI concern. If an organisation cannot inventory, sign, and revoke skills with the same discipline it uses for software artefacts, it will struggle to govern delegated agent behaviour at scale. The most immediate work is to align agent permissions, secrets handling, and provenance policies before adoption outpaces control coverage.

This topic also strengthens the case for treating AI agent permissions as an extension of identity governance rather than a separate tool problem. Skills that can inherit tokens and APIs need the same lifecycle thinking applied to service accounts and other NHI. For readers building this programme, the relevant standards conversation runs through OWASP Non-Human Identity Top 10 and the broader control model around delegated access.

Where skills move across platforms, the governance question becomes whether trust follows the artefact or stays trapped inside a single runtime. That distinction matters because portable agent behaviour can spread faster than manual review cycles. Teams should prepare for tighter provenance enforcement, more explicit sandboxing, and a renewed focus on revocation paths that work across tools, not just within one vendor ecosystem.

For practitioners

• Inventory all installed agent skills Map skills across workstations, claude.ai tenants, and API-based deployments, then assign an owner and lifecycle state to each one. Without that inventory, enforcement, review, and response all fail at the first step.
• Require provenance and signing for skills Block unverified skill sources, enforce source review for SKILL.md content, and pin approved versions so a later update cannot silently change behaviour.
• Scope agent permissions per skill or task Separate file access, network egress, and credential exposure by workflow so one approved skill cannot inherit the full runtime context of the agent.
• Contain execution with sandbox and egress controls Run skills in constrained environments with explicit outbound connection controls and monitoring for hidden helper functions that attempt data exfiltration.
• Add detection for hidden instructions and registry abuse Monitor for suspicious SKILL.md patterns, new registry submissions, and unexpected load-time commands that execute before the model can refuse.

Key takeaways

• Claude Skills create a new agentic supply chain risk because delegated capabilities can inherit broad runtime access, hide malicious instructions, and spread across platforms.
• The evidence points to a visible governance gap, with published analyses showing large numbers of vulnerable skills and a registry environment that can be exploited at scale.
• Practitioners should respond by inventorying skills, enforcing provenance, and scoping agent permissions as part of NHI and identity governance.

Key terms

• Agentic Supply Chain: The collection of models, tools, plugins, prompts, memory stores, and middleware that an AI agent depends on to operate. Weaknesses in this chain can introduce hidden instructions, poisoned context, or exposed secrets, so security teams need inventory, trust validation, and isolation controls across the entire path.
• Consent Enforcement Gap: A consent enforcement gap is the mismatch between what a user has requested and what downstream systems still do with the data. It appears when a valid opt-out is recorded at the edge, but activation, analytics, or vendor workflows continue processing the same record without suppression.
• Shadow AI: AI agents, copilots, or connected tools operating without full visibility or governance from security teams. Shadow AI becomes an identity problem when those systems authenticate with unmanaged tokens, service accounts, or OAuth apps that can reach production resources.
• Skill provenance: The evidence trail showing where an agent skill came from, who published it, what changed, and whether it has been signed or verified. Provenance is the control that helps security teams separate trusted capabilities from impersonation, tampering, and supply chain compromise.

What's in the full article

Akto's full blog covers the operational detail this post intentionally leaves for the source:

• The per-category breakdown of the five Claude Skills risk areas and the OWASP AST10 mapping used to classify them.
• The environment discovery example showing how 400+ agent skills were found on workstations the security team had not mapped.
• The proof-of-concept and registry abuse examples that illustrate malicious payload delivery, privilege inheritance, and platform portability.
• The article's specific references to CVEs, registry flooding, and multi-platform risk propagation that help teams plan detection and response.

👉 Akto's full post covers the five risk categories, evidence from audits, and the control gaps behind agent skill abuse.

Deepen your knowledge

The NHI Foundation Level course, the industry's only accredited NHI security programme, covers NHI governance, secrets management, workload identity, and agentic AI identity. It helps practitioners connect delegated access, privilege control, and lifecycle management across modern identity programmes.