From Threat Model to Framework: Closing the Real Gaps in Agent Skill Security

说明与用途

agent-skills-guard 框架通过扫描技能描述、检测凭证泄露和网络调用，防止隐藏指令，并支持规则更新和安装后变更检测。

问题

AI Agent Skills can hide malicious instructions in their metadata or code, enabling attackers to trigger harmful actions without user awareness.

结果

The framework successfully detects instruction injection in skill descriptions, credential leaks in URLs, and network calls, while allowing easy rule updates and false‑positive management. It also introduces a drift‑check feature to monitor post‑install changes.

工作流

• 1. Install agent-skills-guard and configure rules.json with desired patterns.
• 2. Run a scan on the skill directory; the tool reads SKILL.md and all scripts, applying regex rules to detect hidden instructions, credential leaks, and network calls.
• 3. Review the generated report, noting any HIGH/MEDIUM findings.
• 4. If a finding is a false positive, add a suppression comment in the relevant file with a reason, e.g., # agent-skills-guard: ignore reason="documented internal API".
• 5. Re‑run the scan to see the suppressed finding downgraded to INFO with the attached reason.
• 6. For ongoing security, use the --check-drift flag to re‑hash the skill directory and flag any changes since the last approval.

证据

The framework reads the whole SKILL.md file as one block of text, frontmatter included, so the description field gets exactly the same scrutiny as the body.

来源

After adding one line to rules.json: "hooks\.slack\.com/services/" the scan upgraded a medium finding to high.

来源

# agent-skills-guard: ignore reason="documented internal API, see SKILL.md" downgrades a finding to INFO.

来源