From Threat Model to Framework: Closing the Real Gaps in Agent Skill Security

Description and use

The agent-skills-guard framework protects against hidden instructions in skill descriptions, data leaks, and network calls, enabling rule updates and post‑install change detection.

Problem

AI Agent Skills can hide malicious instructions in their metadata or code, enabling attackers to trigger harmful actions without user awareness.

Outcome

The framework successfully detects instruction injection in skill descriptions, credential leaks in URLs, and network calls, while allowing easy rule updates and false‑positive management. It also introduces a drift‑check feature to monitor post‑install changes.

Workflow

• 1. Install agent-skills-guard and configure rules.json with desired patterns.
• 2. Run a scan on the skill directory; the tool reads SKILL.md and all scripts, applying regex rules to detect hidden instructions, credential leaks, and network calls.
• 3. Review the generated report, noting any HIGH/MEDIUM findings.
• 4. If a finding is a false positive, add a suppression comment in the relevant file with a reason, e.g., # agent-skills-guard: ignore reason="documented internal API".
• 5. Re‑run the scan to see the suppressed finding downgraded to INFO with the attached reason.
• 6. For ongoing security, use the --check-drift flag to re‑hash the skill directory and flag any changes since the last approval.

Evidence

The framework reads the whole SKILL.md file as one block of text, frontmatter included, so the description field gets exactly the same scrutiny as the body.

Source

After adding one line to rules.json: "hooks\.slack\.com/services/" the scan upgraded a medium finding to high.

Source

# agent-skills-guard: ignore reason="documented internal API, see SKILL.md" downgrades a finding to INFO.

Source