Topic starter
06/07/2026 9:42 am
TL;DR: AI agent skills expand the agentic AI attack surface because instructions injected into system prompts can rewrite agent behaviour, access filesystem and network resources, and enable data exfiltration through unreviewed third-party packages, according to Backslash Security. The governance gap is that extensibility now behaves like an identity control plane, not a harmless plugin layer.
Editorial analysis by NHI Mgmt Group, based on content published by Backslash Security: “Governance and Security for AI Agent Skills with Backslash”.
Key questions
Q: What breaks when AI agent skills can change agent behaviour through prompt injection?
A: The failure is that the skill layer stops being a neutral extension mechanism and becomes a trusted instruction path that can redirect agent actions.
Q: Why do unreviewed agent skills create supply chain risk for agentic AI?
A: Because they can bundle hidden instructions, scripts, and dependencies that execute with the agent’s effective authority.
Q: How should teams control filesystem and credential access for AI agent skills?
A: Use task-scoped permissions and deny broad ambient access by default.
Practitioner guidance
- Inventory every installed skill Track where each AI agent skill is installed, which agent or IDE consumes it, and whether it can touch files, network paths, or credentials.
- Require provenance and integrity checks Block any skill that lacks signatures, dependency locks, or a known publisher before it is allowed into a production agent workflow.
- Restrict skill permissions to task scope Remove default access to shell, filesystem, and environment credentials unless the skill’s approved use case explicitly requires them.
Bottom line: AI agent skills can function as privileged instructions, so the main risk is not just code injection but delegated behaviour change inside the agent itself.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
06/07/2026 9:58 am
AI agent skills turn the extensibility layer into an identity boundary. Once skills are injected into the system prompt and can reach filesystems, networks, or environment credentials, they are no longer simple add-ons. They become part of the agent’s delegated authority model, which means identity governance has to treat the skill layer as control-plane territory, not developer convenience.
A few things that frame the scale:
- 67% of organisations still rely heavily on static credentials despite the risks they pose to agentic AI deployments, according to the 2026 Infrastructure Identity Survey.
- Only 13% of organisations feel extremely prepared for the reality of agentic AI despite the majority racing toward autonomous adoption, according to the 2026 Infrastructure Identity Survey.
A question worth separating out:
Q: What should security teams do when a marketplace skill looks useful but unverified?
A: Treat it as untrusted until it passes provenance review, dependency inspection, and policy checks. The fact that a skill appears productive does not make it safe, especially when it can influence agent decisions or move data externally. Organisations should block unverified skills rather than trying to police them after installation.
👉 Read our full editorial: AI agent skills turn the extensibility layer into an identity risk