Your Agent Skills Are Running Unchecked Code

Your Agent Skills Are Running Unchecked Code

That skill you installed to format your meeting notes has full access to your files, your shell, and your network. You did not read its SKILL.md. Nobody does. It runs curl on things you never inspected, pipes untrusted tool output into shell commands, and you will find out when something breaks.

That is the problem. Not the agent. Not the model. The third-party code you gave them.

The problem

Agent skills are scripts you download and run with your own credentials. Most of them come from public repos or registries with no review process at all. The common failure modes:

  1. Hardcoded secrets. API keys, tokens, and webhook URLs committed in scripts or configs, readable by anyone who installs the skill.
  2. Prompt injection surface. The skill reads tool output, web pages, or files you did not write, then acts on them. A malicious page can steer it.
  3. Unsafe execution. Shell commands assembled from untrusted input, downloads that run on arrival, install steps that execute code without asking.
  4. Overbroad permissions. File, network, and credential access the skill does not need for its job, because the author never restricted it.
  5. Invisible data handling. You do not know what the skill reads, writes, or sends out, or where it sends it.

A skill with one of these is a supply chain you never audited.

How it is done

A skill security audit runs the skill through two dedicated scanners, then a human-speed manual review of everything they flag:

  1. Cisco skill-scanner. Automated pass over every file in the skill directory, checking for known dangerous patterns: secret material, command injection, unsafe downloads, suspicious network calls.
  2. Snyk agent-scan. A second scanner with a different rule set, so anything the first misses gets a second look.
  3. Manual review of every flag. Each scanner finding is read in context, not trusted blindly. False positives are thrown out; real issues keep their file and line.
  4. SKILL.md read-through. The instruction file is read top to bottom for permission scope, data-handling claims, and instructions that could steer behavior from untrusted content.
  5. Findings report. Every confirmed issue names the file and line, carries a severity (critical, high, medium, low), and includes a concrete fix recommendation. The report also lists which scanner version or manual pass produced each section, and covers every file in the skill directory.

What you get

  • A findings report covering your skill’s SKILL.md, scripts, configs, and bundled files (up to 30 files).
  • Secret and credential exposure, prompt-injection surface, unsafe execution, overbroad permissions, and data handling, each with file, line, severity, and a fix.
  • The severity scale defined in the report, so you know what to fix first.
  • One clarification round within 7 days of delivery.

Delivery is typically within 3 business days as markdown, by email. If the report is more than 5 business days late, you get a full refund.

Price: free scoping review (48-hour turnaround, a real one-page findings document on your skill’s security posture). The old $49 audit product is now the free door-opener; quoted follow-on only if you want fixes. Pay on acceptance for any follow-on work.

Start with the free scoping review

Read the full service spec: Agent Skill Security Audit.

This service is performed with AI assistance, including automated scanners and AI review. Every deliverable passes a second-model review against the acceptance checklist before it reaches you.