Notifications
Clear all
Topic starter
18/08/2026 2:09 pm
TL;DR: Agent skills written in markdown can vary at runtime, hide unsafe code, and slip past review when sourced from third parties, so IBM Research and Alice are targeting the problem with Mellea and Caterpillar, according to ActiveFence. The real issue is not just code quality but governable trust in machine-generated instructions that now behave like non-human identity inputs.
NHIMG editorial — based on content published by ActiveFence: Securing Agent Skills Before They Run
Questions worth separating out
Q: What breaks when third-party agent skills are not governed like privileged inputs?
A: When agent skills are treated as harmless content, organisations miss the fact that those instructions can steer tools, secrets, and execution paths.
Q: Why do shared credentials create compliance risk for NHI and IAM teams?
A: Shared credentials destroy identity attribution, which means the environment can no longer prove which person or system performed a given action.
Q: How can security teams know if agent skill controls are actually working?
A: Look for evidence that skills are inventoried, risk rated, scanned before execution, and tied to a policy manifest or approval record.
Practitioner guidance
- Inventory all third-party agent skills Create a register of every external skill file, package, or workflow fragment used by production agents, including source, owner, approval status, and connected tools.
- Classify skills by execution privilege Map each skill to the secrets, APIs, and runtime actions it can influence, then label it by privilege tier.
- Require pre-execution compilation or certification Use a compile or certification step to transform prose skills into typed, policy-bound artefacts before they are allowed to run.
What's in the full article
ActiveFence's full blog covers the operational detail this post intentionally leaves for the source:
- The 4-byte cache poisoning explanation and why review tools miss the pattern in practice
- How Python .pyc caching can create inconsistent runtime behaviour across agent skill executions
- The proof-of-concept workflow that demonstrates unsafe skill behaviour before production deployment
- The exact command-line examples for running Caterpillar in alice, OpenAI, and offline modes
👉 Read ActiveFence's analysis of securing agent skills before they run →
Agent skills and the governance gap teams are missing?
Explore further
18/08/2026 3:02 pm
Agent skills create a new trust boundary that current IAM models do not fully describe. These markdown-based instructions are neither ordinary code nor ordinary content, yet they can influence execution, tool calls, and credential use. That makes them a governed input to an agent system, and governed inputs need provenance, inspection, and policy decisions. Practitioner takeaway: security teams should classify agent skills as security-relevant artefacts, not just developer convenience files.
A question worth separating out:
Q: How should organisations respond when a production agent skill is found to be unsafe?
A: Disable the skill, preserve its source and execution logs, identify every workflow that depends on it, and revoke any secrets or permissions it could influence. Then classify the failure mode so the same pattern is blocked at intake, not just removed after the fact.
👉 Read our full editorial: Securing agent skills before they become an AI supply-chain risk
