TL;DR: Malicious skills can quietly instruct agents to download malware, exfiltrate code, or manipulate recommendations, turning agentic AI supply chains into a new attack surface, according to HiddenLayer. The security gap is structural because trust, provenance, and runtime isolation were not designed for skill packages that execute at agent speed.
At a glance
What this is: This research examines how malicious skills turn the agentic AI skills layer into a new supply chain risk, with runtime instruction packages and bundled code creating a path for malware, data theft, and behavioural manipulation.
Why it matters: IAM, security, and platform teams need to treat agent skills like governed software dependencies because the trust boundary now reaches into runtime behaviour, not just package provenance.
Context
Agentic AI skills are modular instruction sets that tell an agent how to use tools, when to act, and what workflow to follow at runtime. In identity terms, the problem is not just code execution but delegated authority over action paths, which makes the skills layer a governance surface rather than a simple extension mechanism.
HiddenLayer argues that the same supply chain pattern that made software dependencies attractive to attackers now applies to skills registries, context files, and bundled scripts in agentic systems. In enterprise settings, that matters because developer workstations already concentrate source code, cloud credentials, CI/CD tokens, and other sensitive development artefacts.
The article frames the risk as a growing mismatch between how fast agentic AI is being adopted and how slowly security controls are adapting. That gap is especially visible where consumer-grade agent behaviour is being imported into enterprise workflows without equivalent provenance, review, or runtime isolation.
Key questions
Q: What breaks when agent skills or setup guides are trusted blindly?
A: Malicious content can inherit legitimate execution paths. A poisoned skill or README can trigger script execution, shell spawning, or secret theft even when the underlying model is behaving as designed. The failure is not just the prompt. It is the absence of provenance checks and command gating at the execution layer.
Q: Why do AI agent skills create supply chain risk in enterprise environments?
A: AI agent skills create supply chain risk because they can look harmless in review while delivering malicious behavior only when executed. If an agent accepts untrusted content and acts on it, attackers can hide instructions, pull payloads from remote servers, or abuse the agent as a dropper. The risk grows when organisations rely on popularity or static checks as proof of safety.
Q: How should security teams implement security skills for AI coding agents?
A: Start with the vulnerability classes that appear most often in your own findings, then write one tightly scoped skill per class. Each skill should include plain-language intent, realistic bad and good examples, and the specific framework or library context the agent needs to make the right decision. That approach is far more reliable than generic secure-coding prompts.
Q: What is the difference between a safe skill and a safe model?
A: A safe model can still behave unsafely if the skill layer tells it to act on malicious instructions. The model provides reasoning, but the skill package provides operational direction. That means safety has to cover both the model and the instruction layer that shapes its actions.
Technical breakdown
How malicious skills abuse runtime instruction trust
A skill is not merely documentation. It is runtime guidance that can direct an agent to call tools, invoke shell commands, query APIs, or shape outputs based on attacker-authored instructions. Because the agent reads the skill at execution time, a malicious package does not need to win a build pipeline or exploit a parser bug to be dangerous. It only needs to be trusted as a legitimate instruction source. The security problem is that the package boundary becomes an authority boundary. Once the agent treats SKILL.md as operational input, a poisoned skill can redirect behaviour while appearing to be normal workflow support.
Practical implication: Treat skill ingestion as a privilege decision, not a convenience feature.
Why unsigned skills create a supply chain blind spot
The skills ecosystem behaves like a package marketplace, but without the assurance properties that mature software supply chains depend on. Unsigned packages, mirror sites, bundled scripts, and weak review processes create a provenance gap: operators cannot reliably tell who authored the skill, whether it was modified, or whether embedded files are safe. That matters because malicious content can hide in natural language instructions as easily as in executable code. In practice, this makes the skills layer structurally closer to an ungoverned dependency registry than to a controlled extension platform, which is why ordinary malware scanning misses part of the risk.
Practical implication: Require cryptographic provenance and review controls before any skill reaches production agents.
How enterprise coding agents expand the blast radius
Enterprise AI coding tools sit next to repositories, local files, and development credentials, so a compromised skill can influence more than one workflow. The article notes risks such as code exfiltration, subtle vulnerability injection, rogue compute consumption, and steering procurement or recommendations through attacker-controlled infrastructure. That is a broader problem than malware delivery. It is a governance failure where the agent becomes a trusted intermediary for decisions that used to require human scrutiny. The result is identity-related exposure through delegated runtime behaviour, especially where developers over-trust the agent’s output.
Practical implication: Scope agent permissions to the smallest viable workspace and monitor outbound behaviour continuously.
Threat narrative
Attacker objective: The attacker wants to turn trusted agent behaviour into a covert delivery path for malware, data theft, or decision manipulation across enterprise workflows.
- Entry begins when a user or developer installs a malicious skill from a public registry, mirror site, or repository that looks legitimate but contains attacker-authored instructions or bundled code.
- Escalation occurs when the agent executes those instructions at runtime with the same trust level as the rest of its workflow, allowing the skill to trigger malware downloads, code exfiltration, or covert recommendation changes.
- Impact follows when the compromised agent influences enterprise development assets, cloud credentials, CI/CD tokens, or procurement decisions, expanding the blast radius from one workstation to downstream systems.
Breaches seen in the wild
- Hugging Face API tokens exposed 2023: Lasso Security found 1,681 live Hugging Face tokens in public code, 655 with write access, reaching 723 organisations including Meta; all were revoked.
- LiteLLM PyPI package breach: LiteLLM PyPI supply chain attack, credentials stolen from users.
Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.
NHI Mgmt Group analysis
Malicious skills create an instruction-trust problem, not just a malware problem. Traditional software supply chain controls focus on code integrity, but skills are read as operational guidance at runtime. That means the attack surface includes behaviour shaping, not only executable payloads. Practitioners need to recognise that agent trust extends to the words inside a skill package, which is a very different governance model from ordinary dependency management.
Skills registries are becoming the control point for agentic AI governance. The article shows that public availability, bundle composition, and weak verification can make a registry the main distribution channel for abuse. That is why the next security debate is not whether agents can be useful, but whether the skill distribution layer is governed enough to deserve trust. For teams, the registration process is now part of the identity perimeter.
Agentic AI supply chain risk is structurally closer to third-party NHI risk than to classic appsec. The dangerous part is delegated runtime authority across tools, files, and APIs, especially when skills can steer actions without a fresh human decision. This is where OWASP-AGENTIC and OWASP-SKILLS become useful lenses, but the operational lesson is simpler: if the agent can act on a skill immediately, the skill itself has become a privileged identity artefact.
Consumer-grade agent abuse will continue to leak into enterprise environments. The article is explicit that personal-machine usage and enterprise workflows are porous, especially for developers. That makes developer workstations a bridge between casual installation habits and corporate blast radius. Organisations should treat that bridge as an identity governance issue, because the same skill package can shape both local actions and enterprise outcomes.
Runtime isolation is the missing assumption in current agent governance. Skills were designed for convenience and reuse, not for adversarial environments where instruction packages may be hostile. The implication is not simply to add more scanning. It is to stop assuming that a skill can be safely executed just because its metadata looks ordinary and its repository is public.
From our research library:
- 88% of organisations have embedded AI agents in their workflows, according to KPMG's 2026 report.
- Read next: Agentic AI Security Guide
What this signals
Skill provenance is becoming an identity control, not a software hygiene task. When an agent reads instructions at runtime, the skill package effectively becomes a delegated authority object. That means provenance, review, and isolation have to be handled like access governance, not optional package vetting. For most programmes, the practical shift is to move scrutiny from the model alone to the entire instruction chain.
Consumer adoption will keep shaping enterprise exposure. HiddenLayer is right to warn that personal-machine experimentation does not stay personal for long, especially in development workflows. The boundary between individual tool choice and enterprise risk is porous, which means agent policy has to cover laptops, registries, and execution environments together.
Skill marketplace growth is outpacing preparedness. Only 13% of organisations feel extremely prepared for the reality of agentic AI despite the majority racing toward autonomous adoption, according to the 2026 Infrastructure Identity Survey. That gap is exactly where malicious skills thrive, because the control surface is expanding faster than review processes, sandboxing, and provenance checks.
For practitioners
- Audit skill ingestion points Inventory every place agents can load skills, extensions, context files, or workflow snippets, including developer laptops and shared registries.
- Require signed skill provenance Block unsigned or unverified skills and require signatures that cover the full package, including bundled scripts and auxiliary files.
- Sandbox agent skill execution Restrict filesystem access, network destinations, and shell command execution so a malicious skill cannot reach sensitive code or external infrastructure.
- Separate trusted and experimental skills Use allowlisted, production-approved skills for enterprise workflows and keep experimental or community skills outside production agent runtimes.
- Monitor agent outbound behaviour Detect unusual network calls, credential access, and file reads that indicate a skill is steering the agent beyond its intended task.
Key takeaways
- Malicious skills turn agentic AI instruction packages into a supply chain risk because they can change runtime behaviour, not just ship code.
- The article shows that unsigned or poorly reviewed skills can quietly drive malware delivery, code exfiltration, or manipulated recommendations.
- The practical response is to govern skill provenance, sandbox execution, and treat agent skills as privileged runtime inputs.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Agentic AI Top 10, OWASP Agentic Skills Top 10 and MITRE ATT&CK address the attack and risk surface, while NIST CSF 2.0 sets the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| OWASP Agentic AI Top 10 | ASI02 — Tool Misuse | Skills in the article direct agents to misuse tools and shell commands at runtime. |
| ASI04 — Agentic Supply Chain Vulnerabilities | Malicious skills and bundled dependencies are the article's central supply chain issue. | |
| Recommendation — Restrict tool execution paths so agent skills cannot misuse approved tools for harmful actions. Verify agent supply chains with signed provenance and review before skills reach production. | ||
| OWASP Agentic Skills Top 10 | AST10 — Malicious Skills | The topic is explicitly malicious skills in agentic AI. |
| Recommendation — Apply AST10-style review to skills, metadata, and bundled code before agent execution. | ||
| MITRE ATT&CK | TA0006;TA0010 — Credential Access; Exfiltration | The abuse paths include credential theft and exfiltration from developer systems. |
| Recommendation — Map malicious skill activity to credential access and exfiltration detections in your monitoring pipeline. | ||
| NIST CSF 2.0 | PR.AA-05 — Access Permissions, Entitlements and Authorizations | Agent skills expand effective permissions and need governed authorization boundaries. |
| Recommendation — Apply PR.AA-05 to limit agent permissions and constrain runtime access by task scope. | ||
Key terms
- Agentic SOC Skill: A task-focused AI workflow that can choose actions, use tools, and produce operational outputs inside a security operations process. Unlike a fixed automation rule, it may adapt its path based on data and context, which makes scope, provenance, and approval controls essential.
- Skills Registry: A catalog of reusable multi-tool workflows that an agent can invoke to complete a task. It extends governance from single tool access to packaged action sequences, which means evaluation, approval, and revocation need to follow the skill itself, not just the underlying tools.
- Device Trust Boundary: The device trust boundary is the point where an endpoint is considered sufficiently verified to access systems, data, or services. It defines the security line between trusted and untrusted device states, based on posture, identity, integrity, and policy. In practice, it governs whether a device can authenticate, connect, or receive sensitive access.
- Provenance Validation: A control approach that verifies where a payment, credential, or approval came from, who authorised it, and whether its path matches expected business logic. It is stronger than appearance-based review because it anchors trust in lineage and context, not visual similarity.
Deepen your knowledge
NHI governance, agentic AI identity, and machine identity security are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.
Published by the NHIMG editorial team on July 5, 2026.
Updated on October 11, 2026.
NHI Mgmt Group, the independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org