What should organisations do when agent skills or extensions need trust review?

How trust review should work for agent skills and extensions

Agent skills and extensions should be treated as runnable supply chain inputs, not as harmless add-ons. The review question is not only what the module does, but what it can inherit, reach, or delegate on behalf of the agent. If an extension can pick up the agent’s credentials, call privileged APIs, or reach broad network destinations, it is part of the trust boundary.

That changes the approval standard. A module that only formats output is very different from one that can authenticate, invoke tools, read secrets, or modify downstream systems. The safer default is to require explicit owner review before any module is allowed to inherit authority, and to block execution until the trust path is understood.

What to inspect before allowing an extension to run

Start with provenance and control. Review who can publish the skill or extension, who can install it, who can update it, and whether those actors are separable. A package that can be silently replaced, auto-updated, or sideloaded creates a larger trust problem than one distributed through a tightly governed store.

Then review the privileges it receives at runtime. Pay close attention to modules that can touch secrets, network egress, internal APIs, browser sessions, or files that contain tokens and configuration material. The decisive issue is not the label on the extension, but whether it can cross from ordinary workflow into trusted execution with identity-bearing material or privileged reach.

• Confirm the publishing and installation path is controlled by an accountable owner.
• Check whether the extension inherits ambient authority from the host agent or platform.
• Limit access to credentials, signed-in sessions, network destinations, and sensitive APIs.
• Require a clear, documented trust path before permitting runtime execution.

Why unclear trust paths become security failures

When trust is vague, the module can become a confused deputy. A skill may appear narrow while actually operating with the agent’s full access, which means a prompt, payload, or hidden action can trigger sensitive behaviour the user never intended. That is especially dangerous when extensions are allowed to chain into other tools or reuse existing authentication context.

It is also a supply chain problem. If the module author, install source, or update channel is not well controlled, then malicious or compromised code can enter the environment through an apparently legitimate extension path. OWASP Agentic Skills Top 10 (AST10) is useful here because it focuses on skill-layer risks such as permission inheritance and credential exposure through agentic skill chains. For a broader agentic perspective, OWASP Agentic AI Top 10 covers identity and privilege abuse, tool misuse, and other runtime abuse paths that matter when extensions act with authority.

What good control looks like in practice

Good control means the extension is only allowed to operate within the minimum authority needed for its function. That usually means task-scoped permissions, explicit policy decisions for sensitive actions, and segmentation between the module and the assets it should never touch. If a module needs credentials or privileged access to do its job, that access should be narrow, observable, and revocable.

For modules that can inherit authority, the review should treat that inheritance as a design decision, not a convenience feature. The safest pattern is to separate installation approval from runtime authorization, and to require a second check for any action that crosses into secrets, production APIs, or network destinations outside the intended scope. AI Agent Authorisation Guide is a practical reference for this least-privilege approach, while Zero Trust for AI Agents reinforces the need to verify the principal and the request before granting action.

Risk and Threat Considerations

Agent skills and extensions are attractive because they sit close to trusted execution. That makes them a strong target for credential theft, privilege abuse, malicious updates, and hidden data exfiltration. The main risk is not just that the module itself is bad, but that it inherits enough authority to turn a small compromise into broad access.

Failure mechanism: The extension is granted more authority than its visible function requires, then uses that authority to access secrets, call privileged APIs, or route data to untrusted destinations.

Impact: A compromised or deceptive module can trigger account abuse, unauthorized actions, lateral movement, or disclosure of credentials and sensitive data across the agent’s trust boundary.

Practitioner Guidance

What to prioritise: Review modules first by authority, not by feature list. If a skill can read secrets, invoke external tools, or act through existing sessions, treat it as security-sensitive even when the user-facing function looks simple.

Decision rule: If you cannot explain why the module needs its requested privileges, do not allow it to run. If the trust path depends on assumptions about the publisher, update channel, or inherited context, require explicit approval and narrower permissions before deployment.

What practitioners underestimate: The dangerous part is often not the extension itself, but the authority it borrows from the host agent. A small module with broad inheritance can create a much larger blast radius than a larger module with tightly bounded access.

Practitioner takeaway: Treat trust review as a privilege review. The goal is to ensure every extension that can touch secrets, sessions, or privileged APIs has a justified, bounded, and observable trust path before it executes.

Related resources from NHI Mgmt Group

• What are Agent Skills and how do they enhance AI performance?
• When should organisations treat an AI agent as a privileged system?
• How can organisations reduce the risk from malicious extensions and agent skills?
• Should organisations trust popularity signals when approving agent skills and integrations?