Auditing Agent Skills: A Threat Model for the Next Generation of AI Package Managers

Short summary

Agent Skills — reusable instruction folders for AI coding assistants like Claude and Copilot — are exploding in popularity, with GitHub adding native install support via 'gh skill install'. The author demonstrates a serious security gap: Skills are not verified by GitHub, can contain hidden prompt injections or malicious scripts, and lazy-loaded files may never be inspected by humans. A proof-of-concept 'csv-formatter' skill shows how attackers can embed silent instructions that tell the AI to perform actions without user awareness.

• •Agent Skills for AI coding tools are proliferating with no verification or review process
• •GitHub explicitly disclaims responsibility for skill safety, leaving users exposed to prompt injection
• •Proof-of-concept malicious skill demonstrates hidden instructions that bypass human inspection

Generated with AI, which can make mistakes.