Notifications
Clear all
Topic starter
24/07/2026 4:10 pm
TL;DR: AI agent skills are turning plain English instructions into a new attack surface, with public marketplaces already showing malicious skills, hidden Unicode backdoors, and credential-harvesting code, according to Noma Security's source article and cited research. The governance problem is no longer just code review, but instruction-layer trust, inventory, and sandboxed execution.
NHIMG editorial — based on content published by Noma Security: AI agent skills and the new attack surface
By the numbers:
- According to OWASP, the AI agent skill ecosystem is under active attack as of Q1 2026.
- ClawHavoc flooded ClawHub with 341 malicious skills between January 27 and 31.
- Snyk scanned 3,984 skills from ClawHub and skills.sh and found that 13.4% contained at least one critical-severity issue.
Questions worth separating out
Q: How should security teams govern agentic AI as it moves into production?
A: Security teams should govern agentic AI as a class of non-human identity, not as a generic application feature.
Q: Why are browser extensions a problem for IAM and NHI teams?
A: Because extensions can operate inside authenticated sessions and reach cookies, tokens, and page data that IAM may not directly see.
Q: What do security teams get wrong about reviewing community AI agent skills?
A: They often review the visible text and forget that the agent reads raw content, not a rendered browser view.
Practitioner guidance
- Inventory all installed skills Build a complete register of every skill deployed across agent environments, including source, version, owner, and last review date.
- Review raw SKILL.md files before approval Inspect the raw source rather than only the rendered marketplace view or pull request display.
- Sandbox agent runtimes by default Run agents in isolated containers or similarly constrained environments, with restricted file-system paths and explicit network egress controls.
What's in the full article
Noma Security's full blog post covers the operational detail this post intentionally leaves for the source:
- The article's examples of malicious skill distribution and marketplace abuse across public ecosystems.
- The specific skill-layer attack patterns, including hidden Unicode and silent exfiltration mechanics.
- The practical review workflow for raw SKILL.md files and bundled scripts before installation.
- The source's discussion of OWASP's Agentic Skills Top 10 and related ecosystem guidance.
👉 Read Noma Security's analysis of AI agent skill risks and instruction-layer attacks →
AI agent skills: what security teams need to govern now?
Explore further
24/07/2026 4:13 pm
Plain English has become part of the control plane. That is the central governance shift in this article, and it should change how identity teams classify risk. A skill is not just content when an agent loads it into context and acts on it; it is an instruction-bearing object with delegated authority. That moves skills into the same governance conversation as secrets, tokens, and service accounts because the behaviour change happens at runtime, not at authoring time.
A few things that frame the scale:
- 80% of organisations report their AI agents have already performed actions beyond their intended scope, including accessing unauthorised systems (39%), inappropriately sharing sensitive data (31%), and revealing access credentials (23%), according to AI Agents: The New Attack Surface report.
- Only 52% of companies can track and audit the data their AI agents access, leaving 48% with a complete blind spot for compliance and breach investigation.
A question worth separating out:
Q: What is the difference between securing the model and securing the skill layer?
A: Securing the model focuses on the AI system itself, while securing the skill layer focuses on the instructions and assets the agent loads at runtime. The model can behave correctly and still be steered into unsafe actions by a malicious skill. Practitioners need both model governance and instruction-layer governance for meaningful control.
👉 Read our full editorial: AI agent skills turn plain English into a new attack surface
