Agent skill instructions: what security teams are missing

TL;DR: The biggest agent risk is not prompt injection or CVEs, but the instruction layer inside skill files, manifests and capability declarations that quietly authorise code execution, file access and autonomous action, according to Tego AI. That hidden layer turns skill text into de facto access control, so governance must move from scanning code to validating declared capabilities against actual need.

Editorial analysis by NHI Mgmt Group, based on content published by Tego AI: “The Hidden Layer: How Agent Skill Instructions Quietly Become Your Biggest Attack Surface”.

By the numbers:

• 1,437 skills combine at least one dangerous capability with no human approval gate whatsoever.
• 78.1% of indexed skills declare file system access.
• 76.0% of indexed skills declare code execution capability.

Key questions

Q: What breaks when agent skills can request broad privileges without review?

A: The authorization model breaks first.

Q: Why do AI agent skills create more risk than ordinary software packages?

A: AI agent skills inherit the permissions of the agent that runs them, so a malicious skill can act inside an existing trust boundary without needing to steal credentials first.

Q: How should security teams decide whether a skill needs human-in-the-loop controls?

A: Use human approval whenever the skill can change state, access sensitive data or call external tools on its own.

Practitioner guidance

• Audit declared skill capabilities Inventory every installed skill, compare each capability flag against the documented function and flag any mismatch as an authorization exception.
• Enforce human approval for dangerous actions Require human-in-the-loop approval whenever a skill can execute code, write files, handle credentials or reach external systems.
• Sandbox skill execution by default Run skills in isolated containers with minimal file, network and process access, and require documented approval for host-mode execution.

Bottom line: Agent skills are an access-control problem as much as an application problem, because their declarations can become the authority an AI agent uses at runtime.

Explore further

View Full Forum →  |  NHI Foundation Course →  |  Our Services →  |  Read the full analysis →