Topic starter
02/08/2026 11:54 am
TL;DR: AI agent skills can smuggle malicious test files into a repository, where Jest and Vitest may auto-discover and execute them with local file and environment access, according to Gecko Security. The real governance gap is that skills are being treated as agent-only content when they also become ordinary repo artifacts.
Editorial analysis by NHI Mgmt Group, based on content published by Gecko Security: “RCE in Your Test Suite: AI Agent Skills and the Attack Vector Skill Scanners Miss”.
Key questions
Q: What breaks when AI agent skills can drop files into a repository that test runners auto-discover?
A: The failure is boundary collapse.
Q: Why do hidden skill directories create risk even when the agent never runs the payload?
A: Because the payload does not need agent execution to be dangerous.
Q: How should security teams handle AI agent skills that land in a repository?
A: They should treat them as repository supply-chain inputs, not just agent instructions.
Practitioner guidance
- Exclude imported skill directories from test discovery Add hidden skill paths such as .agents/ to Jest and Vitest ignore lists so recursive test globs do not treat imported skill files as project tests.
- Enforce file-type allowlists at install time Allow only expected skill assets such as SKILL.md, scripts, references, and approved static assets when copying a skill into the repository.
- Block test and config files in skill bundles Reject files matching patterns like *.test.*, *.spec.*, __tests__, and *.config.* unless a reviewer explicitly opts in for a legitimate reason.
Bottom line: Repository-installed AI skills can become active code paths when hidden files are auto-discovered by common test runners.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
02/08/2026 1:03 pm
Repository trust, not agent trust, is the real control plane: skills that land in a project can inherit the execution privilege of the repository itself, regardless of whether the agent ever touches the payload. That breaks the common assumption that agent-side scanning is enough to manage skill risk. The security question shifts to what else the repo tooling will auto-execute once the files are copied in. Practitioners should govern imported skills as repository supply-chain content.
A few things that frame the scale:
- Claude Code-assisted commits leaked secrets at a rate of 3.2%, more than double the human-only baseline of 1.5%, with peaks reaching 31 secrets per 1,000 commits in August 2025, according to the State of Secrets Sprawl 2026.
A question worth separating out:
Q: What is the difference between agent-side scanning and repository-level containment for AI skills?
A: Agent-side scanning inspects what the AI is told to read or run, while repository-level containment controls what other tools will later treat as trusted project content. The latter is broader and more relevant here because the danger comes from the repo artifact being discovered by test runners, linters, or CI rather than by the agent itself.
👉 Read our full editorial: AI agent skills turn repository files into a hidden execution path