Malicious agent skills expose a new path to AI hijacking

At a glance

What this is: This is an analysis of malicious agent skills and how they can hijack AI agents through hidden instructions, conditional payloads, and deceptive skill packaging.

Why it matters: It matters because teams governing AI agents need to treat skills as a privileged supply-chain input, with identity, authorization, and execution boundaries enforced before a skill ever runs.

Context

Agent skills are packaged instructions that AI systems can load, interpret, and act on, which makes them part of the agent's trust boundary rather than harmless documentation. When those files can be downloaded, shared, or automatically installed, the security question becomes who can influence agent behaviour and under what approval model, especially when the system is expected to act on tasks involving data, code, or connected tools.

The governance gap is that many organisations still treat agent content as advisory, even though a skill can steer execution, trigger scripts, and shape tool use at runtime. That makes skills a form of delegated authority, not merely prompt text, and it places them squarely in the same risk conversation as agent identity and privilege scoping.

Key questions

Q: What breaks when AI agent skills are not reviewed before installation?

A: The main failure is that malicious instructions can hide inside a skill that appears legitimate, then execute under the agent’s delegated access. Without manual review of the repository and skill content, users rely on marketplace reputation signals that can be manipulated. That turns installation into a trust shortcut and makes code execution a supply chain problem.

Q: Why do malicious agent skills create a greater risk than ordinary prompt injection?

A: They are more persistent and more operationally embedded. A malicious skill lives inside a packaged instruction set that the agent may load repeatedly, reuse across tasks, and execute with existing permissions. That makes it closer to a supply-chain compromise than a one-off prompt attack, especially when the skill is distributed through a trusted directory or rollout process.

Q: What are the signs that an agent skill is behaving maliciously?

A: Look for unexpected conditional branches, script execution that is not required for the stated task, requests to handle sensitive data in unusual ways, and agent actions that change from helpful processing to covert transmission or external calls. If a skill only becomes active when certain data types appear, or if it redirects to tools the user did not expect, the behaviour deserves immediate review.

Q: How should organisations govern agent skills in enterprise environments?

A: Treat skills as reusable knowledge packages that need classification, scope limits, and review just like other non-human identity assets. The important decision is not only what the agent can do, but what enterprise context it should be allowed to load in the first place. Skills should be segmented by task and sensitivity so that broad organisational knowledge is not exposed by default.

Technical breakdown

How malicious instructions hide inside skill files

A skill is usually a folder with a SKILL.md file, optional scripts, and supporting resources. The attack surface comes from the fact that the agent reads those instructions as operational guidance, not as passive text. If an attacker can insert a backdoor into the body of the skill, the malicious content can sit inside otherwise legitimate functionality and only activate under specific conditions. That makes code-style review necessary, because the threat is not limited to a malicious file name or obvious payload. The real problem is that the agent may follow the embedded instruction chain exactly as written. See the Agentic AI Security Guide.

Practical implication: Treat skill bundles as executable governance objects and review the full instruction path, not just the front matter.

Why conditional payloads are hard to detect

Conditional exfiltration works because the malicious logic only runs when a target condition is met, such as the presence of PII, PCI, or PHI. That means the skill can appear benign during normal use and only reveal harmful behaviour when the data environment becomes sensitive. This pattern is especially difficult for static review because the malicious branch is buried inside a legitimate workflow and may be disguised as a safety step or helper script. In practice, the danger is not just the payload itself, but the attacker choosing the trigger condition to maximise stealth and selectivity.

Practical implication: Instrument runtime inspection for data-triggered branches and do not rely on static review of the visible skill description alone.

How pre-emption turns skills into a control plane

The article shows that a skill can try to run before other skills and even frame itself as a security check, which creates a control-plane problem. Once pre-emption is possible, the attacker is no longer only changing task output. They are changing which instructions are allowed to execute first, which tools are selected, and which trust decisions happen before the agent acts. That makes ordering, permissioning, and allowlisting core security concerns for multi-skill environments. If the platform cannot reliably arbitrate precedence, the attacker can use the skill system itself to establish influence over downstream behaviour. Read Top 10 Agentic AI Identity Issues.

Practical implication: Enforce deterministic skill precedence and test whether untrusted skills can outrun defensive checks in your agent runtime.

Threat narrative

Attacker objective: The attacker wants to hijack trusted agent behaviour so the agent leaks sensitive data, executes malicious instructions, or becomes a foothold for broader enterprise compromise.

1. Entry occurs when a user or platform installs or loads a malicious skill from a public directory or bundled skill package.
2. Credential and data access occur when the skill conditionally targets sensitive content such as PII, PCI, or PHI and turns that context into a trigger.
3. Escalation happens when the agent follows the hidden instruction path, runs attacker-controlled logic, or executes arbitrary code with the agent's existing privileges.
4. Impact includes covert exfiltration, command execution, and movement into broader enterprise workflows or systems through the compromised agent path.

Breaches seen in the wild

• ClawHub malicious skills 2026: Hundreds of malicious ClawHub skills for the OpenClaw agent pushed credential stealers in early 2026; Koi found 341 of 2,857 in the ClawHavoc campaign.
• CoPhish OAuth phishing via Copilot Studio: Datadog showed Copilot Studio agents on a Microsoft domain can front OAuth consent phishing and forward stolen tokens; no victims reported.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Malicious agent skills create a governance problem, not just a content-review problem. The attack surface is the packaging, distribution, and runtime interpretation of skill instructions, which means the control boundary moves from human review to agent execution. When a skill can influence scripts, tool selection, and conditional branches, the organisation is governing delegated authority rather than static documentation. Practitioners should treat skill onboarding as an identity and approval event, not a file import.

Agent skills expose a new form of trust transitivity. Users may trust the task, the skill directory, and the agent, yet the malicious content can sit inside the middle of that chain. That is why this risk maps cleanly to agent identity issues and to supply-chain thinking: the system inherits trust from a source that may not deserve it. Practitioners should assume every installed skill can alter not only output, but also the route an agent takes to produce it.

The named concept here is skill payload smuggling. It describes the insertion of malicious instructions into a legitimate skill so the hostile logic is masked by useful functionality. That pattern is more durable than a plainly malicious package because it lowers user suspicion and improves execution odds. The practical lesson is that detection must look for hidden behavioural branches, not just obviously bad content.

Central skill management can amplify both benefit and blast radius. The article makes clear that centrally managed, automatically installed skills improve convenience while also creating a single place where an attacker can reach many agents at once. That raises the value of provenance checks, approval workflows, and runtime containment for every centrally distributed skill. Practitioners should assume that enterprise-wide skill rollout converts a local compromise into a fleet-level identity and execution risk.

From our research library:

• A May 2025 Gartner poll of 147 CIOs and IT leaders found that 24% had already deployed AI agents, 50% were experimenting and 17% planned to deploy by the end of 2026.
• Read next: Agentic AI Security Guide

What this signals

Skill payload smuggling: the most important lesson is that malicious logic can hide inside useful agent content, which forces security teams to inspect not just prompts but the execution path created by packaged instructions. The boundary now sits at installation, interpretation, and runtime use, so governance has to cover all three stages.

Agent skill governance will increasingly converge with identity governance because the real risk is delegated authority. Once a skill can alter tools, scripts, and precedence, the question is no longer whether the content looks harmless, but whether the agent is allowed to trust it at all. Teams that cannot answer that question will struggle to secure centrally managed skills at scale.

For practitioners

• Review skill bundles as executable content Inspect SKILL.md files, attached scripts, and resource files before allowing installation, and require approval for any skill that can invoke tools or scripts.
• Restrict automatic skill installation Disable silent or automatic skill rollout where possible so centrally managed skills cannot reach every agent without an explicit governance checkpoint.
• Scan for conditional data-triggered logic Look for instructions that activate only when sensitive data appears, especially branches tied to PII, PCI, PHI, or other high-value content.
• Test defensive pre-emption controls Validate whether any defensive or policy skill can actually run before untrusted skills and whether ordering can be subverted by a malicious package.
• Constrain tool and script permissions Limit the tools and scripts a skill can use so a compromised skill cannot pivot from language instruction into code execution or exfiltration.

Key takeaways

• Malicious agent skills turn trusted instruction bundles into a delivery mechanism for hidden behaviour, so the governance gap sits inside the skill lifecycle itself.
• The article shows that attackers can use conditional logic and pre-emption to hide malicious actions until the right data or execution state appears.
• The most effective control is to treat skill installation, precedence, and runtime use as privileged decisions rather than routine content loading.

Related NHI Mgmt Group resources: Agentic AI Identity Guide · Agentic AI Security Guide · AI Agent Observability, Audit and Incident Response Guide · Top 10 Agentic AI Identity Issues

Key terms

• Agent Skill: A reusable package of task-specific knowledge and procedures that an autonomous agent can load when needed. In practice, it separates general awareness from operational detail, which makes enterprise context easier to govern than a single oversized prompt.
• Skill Payload Smuggling: The insertion of malicious logic into an otherwise legitimate agent skill so the hostile behaviour is hidden by useful functionality. This pattern is difficult to spot because the skill still appears to support the advertised task while quietly carrying instructions for exfiltration, code execution, or control redirection.
• Pre-Emption: A rule that determines whether a federal law overrides or limits state privacy laws in the same area. In practice, pre-emption affects how many overlapping obligations organisations must track, and whether privacy teams can build one national programme or several state-specific ones.
• Conditional Exfiltration: A malicious technique where data theft only occurs when a specific condition is met, such as the presence of sensitive records or a particular file type. This makes the payload less visible during ordinary use and more likely to evade basic testing or static review.

Deepen your knowledge

NHI Foundation Level course, the industry's only accredited NHI security programme, covers NHI governance, agentic AI identity, and machine identity security. It helps practitioners translate identity controls into operating rules for agents, skills, and other non-human actors.