What is an agent skill and what security risks does it introduce?

An agent skill is a packaged folder of instructions, scripts, and resources that an agent loads into its context to perform a specific task. Anthropic's Agent Skills format uses a SKILL.md file with metadata that the model reads and decides when to invoke. The security consequence is direct: a skill is untrusted text with instruction-level authority, distributed like a plugin and reviewed like a document.

Six risks follow from that:

• The instructions are executable by design, so a malicious or compromised skill is prompt injection with a distribution channel

• Skills can bundle scripts, which means code executes with the agent's permissions rather than merely influencing its language

• Distribution is often informal, shared through repositories or internal channels with no signing or provenance

• Updates can change behavior silently, the same rug-pull pattern that affects MCP servers

• Multiple loaded skills can interfere, with one skill's instructions overriding another's constraints

• Skills consume context, which creates a denial-of-service and cost vector at scale

The organizational risk is quieter. Skills encode workflow knowledge, which means they accumulate credentials, internal endpoints, and process detail, and they get copied between teams without review.

Treat them as you would any dependency: an internal registry, review before use, version pinning, diff on update, and a rule that skills bundling executable code require code review rather than a read-through.

Akto Atlas inventories what agents in the organization have loaded, including skills and connected MCP servers, which is the visibility any of these controls depends on.

A skill is a config file with the authority of a system prompt. Review it like code, not like documentation.