Beyond Maliciousness: Attack Surface Profiling of Agent Skills

Paper: Beyond Maliciousness: Static and Runtime Attack-Surface Profiling of Agent Skills (Opens in a new tab)

A few months ago, we started researching AI skills with one question in mind: If I download and install a skill from a community marketplace, what capabilities and authority am I automatically assigning to that skill? In other words, what is the attack surface profile of these skills. Our research led us to the findings which we spell out in the research paper.

An agent skill is a SKILL.md file of instructions plus whatever scripts and additional files its author ships. Once an agent loads it, the instructions direct the agent and the scripts run inside the agent’s session.

That session already holds a shell, a filesystem, network access and credentials. Installing a skill “grants authority (the standing to direct the agent, not new privilege),” and it does so persistently, without per-action confirmation. In the paper’s words, “What a skill can reach is the agent’s existing ambient authority.”

The ceiling is therefore the agent’s own authority, and a skill that turns it against the user makes the agent a confused deputy. What varies is how much of that authority each skill puts into play, which is what we measured.

A skill’s authority is the agent’s ambient authority#

If an agent can read SSH keys, call internal APIs or push code to production, so can every skill it loads. In our sample, most skills put a substantial share of that reach into play:

• 70% carry at least one elevated capability.
• 50% show evidence of shell execution.
• 31% can reach the network, and 13% can reach credentials.

The shell figure matters most, because “a shell is a general capability and the classes beneath it are largely reachable through it.” For half the corpus, the practical ceiling is the agent itself. Skills also inherit the agent’s amplifiers. Autonomy appears in about a quarter of listings and memory use in about a fifth, properties that make “a capability reach further in an agent than it would in a script.”

Benign intent does not limit that authority#

Malicious intent and ambient authority are separate axes. Only about 5% of listings carry a threat verdict, against 70% carrying an elevated capability.

“Capability is the common condition, exposure is frequent, and malicious intent is rare.”

Every listing with a threat verdict sits at medium exposure or above, but the reverse does not hold: about 80% of skills at the two highest exposure levels carry no threat verdict. That population “is not detectable as malice,” and a manual read of a random benign sample found no missed threats. A security review that only checks “whether a skill is hostile” would approve skills with broad reach into the agent’s authority.

Nothing in the skill format narrows it#

A skill can only be held below the agent’s authority if something in the skill file format enforces a narrower grant. The skill format has a single permission-shaped field: a list of tools the skill pre-approves. Honestly, that field is doing the opposite: “It is a grant, not a restriction.” In at least one major agent it removes confirmation prompts for the listed tools while maintaining the status quo for every other tool as well.

In practice, only about 13% of listings declare anything, 59% of those understate what their bundle can do, and the vocabulary is insufficient to express credential or environment access. This shows that even having an accurate declaration would not fix the broad reach problem: “Even an accurate declaration therefore cannot establish the limits of actions performed through a shell or an invoked script.”

The authority extends to the skill’s dependencies#

A skill might pull in dependencies from npm, PyPI, or any other package repository for its proper functioning. Not surprisingly, these dependencies also run with the same authority as the skill, which is the same as the agent’s. We found that among listings that declare a dependency, 99% leave at least one unpinned, and some resolve to takeover-prone packages. Whoever controls those dependencies tomorrow will by design inherit the agent’s authority. This makes the agent prone to “supply chain attacks”. The paper calls this “the surface through which a listing that is benign today becomes something else tomorrow without its author acting.”

What security teams should do#

If a skill’s ceiling is the agent’s authority, the most reliable control is the agent’s authority itself.

• Runtime monitoring of agents. It is essential to continuously monitor the agent’s runtime behavior to ensure the skill instructions the agent is executing are not leading to any security issues.
• Reduce the agent’s blast radius. Scope credentials, restrict egress and isolate sessions that load third-party skills, so every skill inherits less.
• Treat each skill install as a full grant. Inventory skills per agent, and review them as code running with that agent’s privileges.
• Profile the bundle, not the declaration. Prioritize combinations: credential access with network egress (about 6% of listings), or the lethal trifecta of private data, untrusted content and an outbound channel (about 10%).
• Pin skills and their dependencies, and re-review on update.

Scope#

The skill corpus is a popularity-banded sample of two marketplaces. The skills are scanned via SkillTracer (Opens in a new tab), which is a free-to-use scanner built and operated by Metano MARS Labs.

https://labs.metano.ai/scanner (Opens in a new tab)

Read the paper#

The full methodology and limitations are in the paper.

Beyond Maliciousness: Static and Runtime Attack-Surface Profiling of Agent Skills (Opens in a new tab)

Ratnesh Pandey, Japneet Singh, Harsh Akshit, Sonali Tyagi, Cassie Crossley. arXiv:2610.19264 (Opens in a new tab) [cs.CR], October 2026.