Notifications
Clear all
Topic starter
02/08/2026 11:54 am
TL;DR: AI agent skills can smuggle malicious test files into a repository, where Jest and Vitest may auto-discover and execute them with local file and environment access, according to Gecko Security. The real governance gap is that skills are being treated as agent-only content when they also become ordinary repo artifacts.
NHIMG editorial — based on content published by Gecko Security: AI agent skills turn repository files into a hidden execution path
Questions worth separating out
Q: How should security teams handle AI agent skills that land in a repository?
A: They should treat them as repository supply-chain inputs, not just agent instructions.
Q: What breaks when hidden directories are included in test discovery?
A: Hidden directories become part of the execution boundary, which means untrusted files can run with the same privileges as trusted project tests.
Q: Why do skills create a bigger risk than prompt injection alone?
A: Because the risk extends beyond what the agent reads and into what the repository tools execute automatically.
Practitioner guidance
- Add hidden skill directories to test exclusions Exclude .agents/ and similar paths in Jest, Vitest, and CI so repository-resident skill files cannot be auto-discovered and executed.
- Apply a file-type allowlist at skill install time Permit only SKILL.md, approved scripts, references, and assets when importing a skill into a repo, and block test, config, and build files by default.
- Review imported skills as repository content Treat every installed skill as untrusted code-adjacent material until the full directory tree has been inspected, not just the markdown instructions.
What's in the full article
Gecko Security's full article covers the operational detail this post intentionally leaves for the source:
- The exact installer behaviour that copies skill directories into .agents/skills/ and leaves most files intact.
- The test runner discovery patterns for Jest and Vitest that make hidden directories eligible for execution.
- The proposed installer-side file allowlist and registry-side screening checks that this article only summarises.
- The concrete example configurations for excluding .agents/ paths from local and CI test runs.
👉 Read Gecko Security's analysis of AI agent skills and hidden test execution →
AI agent skills in repos: is your test runner the real risk?
Explore further
02/08/2026 1:03 pm
Hidden repo artifacts create an identity boundary failure: The core issue is not that AI agent skills are inherently dangerous, but that repository ingestion expands trust from a named skill package into everything the package carries. That breaks the assumption that only agent-invoked instructions matter. Security teams need to treat the repository as the actual execution domain, because that is where developer tools decide what to trust.
A few things that frame the scale:
- Only 44% of developers are reported to follow security best practices for secrets management, exposing a significant developer behaviour gap, according to The State of Secrets in AppSec.
- The average estimated time to remediate a leaked secret is 27 days, despite 75% of organisations expressing strong confidence in their secrets management capabilities.
A question worth separating out:
Q: What should teams do immediately to reduce skill-based supply-chain risk?
A: They should block auto-execution of imported skill directories, enforce a strict file allowlist during installation, and add CI guardrails that ignore hidden skill paths. Those three changes cut off the easiest route from packaged content to secrets exposure and reduce the chance that a malicious or careless skill can persist in source control.
👉 Read our full editorial: AI agent skills turn repository files into a hidden execution path
