Does bundling code with skills create hidden security risks?
Agent skills combine instructions with executable code and system access. This packaging enables reuse but may also enable attacks—especially when skills are composed together or shared across platforms without adequate inspection.
The introduction defines a skill as something that "usually combines task instructions, tool interfaces, executable scripts, and external resources into a reusable module." It credits that modularity with reuse, scalability and "the rapid growth of agent frameworks and skill-sharing platforms." Then it turns the same fact into the risk: "a skill may do more than provide text instructions," because it "can execute code, read or write files, call external APIs, and access system resources."
That changes what adopting a skill is. The vault's skill notes treat a skill as something to route (How should agents route across thousands of skills?), govern as a file (Can person-grounded skills remain auditable without hidden prompt state?) or optimize as text (Can skill documents be optimized like neural network weights?). In each of these the skill is treated mostly as a document an agent reads. The paper's framing adds another: a skill carries authority, closer to a package a program depends on than to a prompt. My reading is that installing one from a shared platform extends the agent's reach to whatever its author put in. The package comparison is mine, and the excerpt does not use it. The excerpt's own attack shows a second mismatch on top: the unit that gets shared and scanned is the skill, while the unit at which harm can arise is the chain of skills (Can skill scanners miss attacks hidden across multiple skills?).
Any channel that moves skills between agents also moves this risk. How can agent systems share learned skills across users? describes one such channel, an evolver that edits skills and synchronizes them to all agents. Its excerpt says nothing about adversarial skills, so the link is a vault inference.
The strongest objection is that the framing is asserted here and not shown. The introduction backs it with citations (Jia et al. 2024; Huang et al. 2026; Ruan et al. 2024) whose evidence the excerpt does not reproduce, and "attack surface" is argued from what a skill can do, not from measured prevalence of malicious skills.
What the excerpt does not give. How common malicious skills are on sharing platforms, what permission model OpenCode, Claude Code or Codex apply to a skill's scripts, and how skills are installed and trusted.
Inquiring lines that read this note 2
This note is a source for these research framings, grouped by the broader line of inquiry each explores. Scan the bold lines of inquiry; follow any specific question forward.
How do persistent skill repositories improve agent reliability over time?Related concepts in this collection 5
This note in its neighbourhood — explore the map, then jump to a related concept in the list below.
Click a node to walk · click center to open · click Open in graph to see this note in the full knowledge graph
-
How should agents route across thousands of skills?
As skill libraries grow, should routing focus on selecting one skill or composing many? This explores whether decomposition and chaining creates better task execution than single-skill selection.
the demand side of skills; this note is the exposure that comes with it
-
Can person-grounded skills remain auditable without hidden prompt state?
Explores whether treating extracted expertise as versioned files—rather than persona prompts—enables meaningful accountability over person-grounded knowledge. Matters because audit trails determine whether captured skills can be corrected, rolled back, or safely withheld.
the governance view of the same object; its "inspect" step is the one the attack passes
-
Can skill documents be optimized like neural network weights?
Explores whether natural-language skill artifacts—packaging procedures, heuristics, and policies—can be systematically improved through iterative editing and validation, similar to how gradient descent refines model parameters.
skills as editable external state, where this note adds that the state can carry executable reach
-
How can agent systems share learned skills across users?
Individual users operating autonomous agents independently rediscover solutions because systems lack mechanisms to propagate discoveries. Can centralized aggregation and automatic evolution convert isolated experiences into shared capabilities?
a skill distribution channel; the security reading is a vault inference
-
Can skill scanners miss attacks hidden across multiple skills?
Current security scanners check each skill individually for malicious behavior. This explores whether attackers can split a harmful objective across multiple benign-looking skills that pass inspection separately but form a dangerous chain when composed together.
the attack that makes this surface concrete
Related papers in this collection 8
Papers most semantically related to this note, ranked by cosine similarity in the embedding space.
- ColluSkill: Adversarial Cross-Skill Composition for Evading Agent Skill Scanners
- Demystifying Agent Skills: Why They Work-Until They Don't
- Equipping agents for the real world with Agent Skills
- RESOURCE2SKILL: Distilling Executable Agent Skills from Human-Created Multimodal Resources
- Code as Agent Harness
- MUSE-Autoskill: Self-Evolving Agents via Skill Creation, Memory, Management, and Evaluation
- Grounded Skill Synthesis from Code at Scale for Agentic Intelligence
- LatentSkill: From In-Context Textual Skills to In-Weight Latent Skills for LLM Agents
Original note title
the packaging that makes an agent skill reusable also makes it an attack surface — a skill bundles instructions tool interfaces scripts and resources and can execute code and reach the system