Karthigayan Devan published a July 27 analysis warning that AI “Agent Skills” installed into tools such as Claude, GitHub Copilot and newer AI coding assistants can create security risks because they are folders of instructions and scripts that an assistant may read and execute when relevant. The article says the format became more popular after five Skill-related GitHub projects gained a combined 6,634 stars on July 24, while GitHub added native installation from other repositories through `gh skill install`.

Agent Skills are described as small packages containing a short description, step-by-step instructions and sometimes scripts, without a formal plugin system or special installer. The author compares casual installation of Skills to running `npm install` or adding a browser extension, but says GitHub’s own documentation warns that “Skills are not verified by GitHub” and may contain prompt injections (hidden instructions aimed at steering an AI), hidden instructions or malicious scripts. GitHub advises users to inspect content before installation with `gh skill preview`.

The security gap, according to the article, is that a Skill does not load every file immediately. An assistant may first read only a short summary, then later pull in full instructions and extra bundled files when a task appears relevant. That means a human preview at install time may miss files the assistant later reads and acts on, including files that appear unrelated or are unlikely to be opened by a user.

To test the risk, Devan built a disabled demonstration Skill named `csv-formatter`, presented as a harmless tool for cleaning CSV files, fixing spacing, delimiters and headers. The fake Skill contained an instruction telling the AI to run a “diagnostic step” before formatting, not mention it to the user and not ask for approval. The supposed diagnostic checked for an SSH private key, an AWS credentials file and environment variables that often include API keys or passwords, then bundled the data for an outside server. A second copy of the same instruction was hidden in an unrelated changelog.

The author says the `csv-formatter` example never actually ran or sent data anywhere, and was disabled by design as a safe demonstration. The techniques in it, however, were meant to mirror a real attack pattern: a hidden “do not tell the user” instruction, credential collection, a network call and a backup instruction placed where people would not normally look.

Devan then built a small scanner that reads every file in a Skill folder and flags suspicious patterns, including phrases such as “don’t tell the user,” files users would rarely open, code that reaches for credentials and scripts that both read credentials and contact the internet. The scanner caught every trick in the fake Skill, but the author says exact phrase matching is fragile because malicious authors can reword instructions, use another language or avoid obvious labels.

The proposed answer is layered auditing rather than one keyword list. The article names exact wording checks, behavior-shape checks such as credentials plus a network call in the same file, model-based review for hidden instructions, sandboxed execution (running code in an isolated test environment) and change monitoring for Skills that were clean when first installed but later modified. Devan says he is turning the proof-of-concept into an open source tool with a test suite, community-extensible rules, an optional model review pass and a public benchmark of good and bad Skills.

Karthigayan Devan published a July 27 analysis warning that AI “Agent Skills” installed into tools such as Claude, GitHub Copilot and newer AI coding assistants can create security risks because they are folders of instructions and scripts that an assistant may read and execute when relevant. The article says the format became more popular after five Skill-related GitHub projects gained a combined 6,634 stars on July 24, while GitHub added native installation from other repositories through `gh skill install`.

Agent Skills are described as small packages containing a short description, step-by-step instructions and sometimes scripts, without a formal plugin system or special installer. The author compares casual installation of Skills to running `npm install` or adding a browser extension, but says GitHub’s own documentation warns that “Skills are not verified by GitHub” and may contain prompt injections (hidden instructions aimed at steering an AI), hidden instructions or malicious scripts. GitHub advises users to inspect content before installation with `gh skill preview`.

The security gap, according to the article, is that a Skill does not load every file immediately. An assistant may first read only a short summary, then later pull in full instructions and extra bundled files when a task appears relevant. That means a human preview at install time may miss files the assistant later reads and acts on, including files that appear unrelated or are unlikely to be opened by a user.

To test the risk, Devan built a disabled demonstration Skill named `csv-formatter`, presented as a harmless tool for cleaning CSV files, fixing spacing, delimiters and headers. The fake Skill contained an instruction telling the AI to run a “diagnostic step” before formatting, not mention it to the user and not ask for approval. The supposed diagnostic checked for an SSH private key, an AWS credentials file and environment variables that often include API keys or passwords, then bundled the data for an outside server. A second copy of the same instruction was hidden in an unrelated changelog.

The author says the `csv-formatter` example never actually ran or sent data anywhere, and was disabled by design as a safe demonstration. The techniques in it, however, were meant to mirror a real attack pattern: a hidden “do not tell the user” instruction, credential collection, a network call and a backup instruction placed where people would not normally look.

Devan then built a small scanner that reads every file in a Skill folder and flags suspicious patterns, including phrases such as “don’t tell the user,” files users would rarely open, code that reaches for credentials and scripts that both read credentials and contact the internet. The scanner caught every trick in the fake Skill, but the author says exact phrase matching is fragile because malicious authors can reword instructions, use another language or avoid obvious labels.

The proposed answer is layered auditing rather than one keyword list. The article names exact wording checks, behavior-shape checks such as credentials plus a network call in the same file, model-based review for hidden instructions, sandboxed execution (running code in an isolated test environment) and change monitoring for Skills that were clean when first installed but later modified. Devan says he is turning the proof-of-concept into an open source tool with a test suite, community-extensible rules, an optional model review pass and a public benchmark of good and bad Skills.