Topic starter
24/07/2026 4:10 pm
TL;DR: AI agent skills are turning plain English instructions into a new attack surface, with public marketplaces already showing malicious skills, hidden Unicode backdoors, and credential-harvesting code, according to Noma Security's source article and cited research. The governance problem is no longer just code review, but instruction-layer trust, inventory, and sandboxed execution.
Editorial analysis by NHI Mgmt Group, based on content published by Noma Security: “That’s a Great Question – Who Wrote the Instructions Your Agent Is Following?”.
Key questions
Q: What breaks when AI agent skills are treated like documentation instead of runtime policy?
A: The review model breaks because the agent consumes skill instructions as operational input, not as explanatory text.
Q: Why do malicious AI agent skills create data exfiltration risk?
A: Because the skill can inherit the agent’s existing filesystem, network, and secret access, then use that access through bundled scripts or instruction-driven behaviour.
Q: What are the signs that an AI skill marketplace is becoming unsafe?
A: Watch for low publishing friction, rapid installation growth, minimal moderation, weak provenance checks, and an increase in skills that request broad access for narrow tasks.
Practitioner guidance
- Implement skill inventory and ownership Track every installed skill, its source, last review date, and accountable owner so you can govern what agents can load into context.
- Review raw skill source before approval Inspect the underlying SKILL.md and any bundled files, not just the rendered marketplace page, because hidden Unicode and embedded instructions can change what the agent follows.
- Isolate agent runtimes Run agents in sandboxed environments with restricted filesystem paths, container boundaries, and controlled network egress so a malicious skill cannot inherit full environment trust.
Bottom line: AI agent skills expand the attack surface by turning plain-English instructions into runtime control input, which changes how trust has to be assigned and reviewed.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
24/07/2026 4:13 pm
Instruction-layer trust is now an identity governance problem, not a documentation problem. When an agent loads a skill, it is not reading instructions as static text, it is inheriting authority from them. That means the review question is no longer only whether the model is constrained, but whether the instruction source is governed with the same discipline as credentials or code. For practitioners, the control boundary has moved to the moment the skill is trusted.
A few things that frame the scale:
- Only 44% of developers are reported to follow security best practices for secrets management, exposing a significant developer behaviour gap, according to the State of Secrets in AppSec.
A question worth separating out:
Q: How should security teams govern reusable AI agent skills in a controlled workflow?
A: Teams should treat reusable agent skills like governed configuration, not loose prompt files. Use review, approval, versioning, and scoped installation so the same skill behaves predictably across users and projects. That reduces drift, makes changes auditable, and helps security leaders control how agent behavior is distributed inside the organisation.
👉 Read our full editorial: AI agent skills turn plain English into a new attack surface