From Threat Model to Framework: Closing the Real Gaps in Agent Skill Security

Description and use

The agent-skills-guard framework detects hidden instructions in skill descriptions, identifies credential leaks, and supports rule extension and false‑positive suppression, enhancing trust in AI agent skills.

Problem

AI Agent Skills can hide malicious instructions in their description or code, leading to unauthorized actions such as silent data exfiltration or credential leakage.

Outcome

The framework successfully detects hidden malicious instructions in skill descriptions, identifies credential leakage via hardcoded URLs, and allows easy rule extension and false‑positive suppression, improving trust in AI agent skills.

Workflow

• 1. Install agent-skills-guard and run a scan on a skill repository.
• 2. The scanner reads the full SKILL.md, including the description field, and applies regex patterns from rules.json.
• 3. Detected issues are reported with severity levels (HIGH, MEDIUM, LOW, INFO).
• 4. Users can add new patterns to rules.json without modifying code.
• 5. For false positives, add a comment with the format # agent-skills-guard: ignore reason="…" to suppress and downgrade the finding.
• 6. Optionally run --check-drift to re‑hash the skill directory and flag any changes since approval.

Evidence

The framework reads the whole SKILL.md file as one block of text, frontmatter included, so the description field gets exactly the same scrutiny as the body.

Source

Adding one line to rules.json turns a medium finding into a high finding for a Slack webhook URL.

Source

# agent-skills-guard: ignore reason="documented internal API, see SKILL.md" suppresses a false positive while keeping a record.

Source