Topic starter
11/11/2026 6:05 pm
TL;DR: A Claude Code skill tried to collect a GitHub token, and in controlled tests some commands executed before the model could refuse the skill, according to HikmaAI research. For practitioners, the execution path around the model matters as much as the prompt or response layer.
Editorial analysis by NHI Mgmt Group, based on content published by HikmaAI: “A malicious coding-agent skill tried to steal a GitHub token. What should teams check?”.
Key questions
Q: Why do model refusals fail to stop malicious agent commands?
A: Model refusals fail because an agent can ignore or work around a model’s safety response by using other tools, alternate prompts, or hidden instructions in retrieved content.
Q: How should teams structure code review context for AI coding agents?
A: Teams should put the change intent, expected impact, and breaking behavior in the PR itself, not in side conversations or private knowledge.
Q: How do coding-agent skills create token-exposure risk?
A: Coding-agent skills create token-exposure risk when they can execute shell commands, read local credentials and reach outbound endpoints before a model reviews the visible content.
Practitioner guidance
- Review skills as executable code Inspect frontmatter, shell steps and nested files before allowing any agent to load the skill.
- Block pre-model shell execution Disable or tightly constrain any command that runs during skill preparation, especially commands marked with `!` or equivalent pre-execution hooks.
- Limit token scope and egress paths Reduce which credentials the agent can reach and restrict outbound destinations from the host so an execution path cannot both read a token and upload it.
Bottom line: Coding-agent skills can behave like executable software, so their security profile extends beyond the text the model sees.
Glossary terms: Claude Code skill, Dynamic context awareness, GitHub Token, Shell Command Execution
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
11/11/2026 6:07 pm
Skills have crossed from prompt content into executable supply-chain artefacts: The security question is no longer whether a model can spot malicious text, but whether a skill package can run code before the model ever evaluates the visible instructions. That changes review from content moderation to software-style inspection, with special attention to pre-model shell execution. Practitioners should treat agent skills as code paths with identity impact, not as documentation.
A few things that frame the scale:
- Claude Code-assisted commits leaked secrets at a rate of 3.2%, more than double the human-only baseline of 1.5%, with peaks reaching 31 secrets per 1,000 commits in August 2025, according to the State of Secrets Sprawl 2026.
A question worth separating out:
Q: What is the difference between prompt injection and skill execution risk?
A: Prompt injection is malicious input that steers a model to produce unsafe instructions, while skill execution risk is the damage that occurs when an agent actually carries out a tool action, such as sending data or changing a record. The first targets model behaviour. The second targets delegated execution through APIs, scripts, and credentials. skill execution risk
👉 Read our full editorial: Claude Code skill runs token-stealing commands before refusal