Source: Cloud Security Alliance
Author: unknown
URL: https://www.akto.io/blog/claude-agent-risks-for-cisos
ONE SENTENCE SUMMARY:
Claude SKILL.md agent skills mirror npm supply-chain risks, with widespread vulnerabilities, weak governance, over-privilege, stealthy markdown payloads, and cross-platform propagation.
MAIN POINTS:
- Claude Skills extend agents quickly but significantly expand the enterprise attack surface.
- Multiple audits show 26.1%–36.82% of skills contain at least one security flaw.
- OWASP introduced Agentic Skills Top 10 (AST10) in March 2026 to classify risks.
- Ungoverned installations create skill sprawl without inventory, SOC visibility, or centralized control.
- Silent skill loading from local directories enables unmanaged execution on developer workstations.
- Open registries allow poisoning via impersonation, malware uploads, and absent provenance mechanisms.
- Upstream compromise can trigger credential theft or execution merely by cloning untrusted projects.
- Skills inherit full agent context, causing over-privileged access to tokens, secrets, and PII.
- Markdown instructions can covertly direct exfiltration, evading traditional code-signature scanners.
- Cross-platform SKILL.md portability enables rapid reindexing, unsafe updates, and inconsistent permission behaviors.
TAKEAWAYS:
- Building a complete skill inventory is prerequisite to least privilege, scanning, and incident response.
- Treat skill registries like hostile supply chains without signing, verification, and publisher trust controls.
- Enforce per-skill isolation and sandboxing to prevent “one approval, infinite permissions” failures.
- Detect instruction-based threats by analyzing natural-language behaviors, not just executable code patterns.
- Containment requires immutable version pinning and update governance across every platform indexing SKILL.md.