AI Systems Atlas

S-16Skill & Plugin Supply Chain

/security/skill-supply-chain

Installing a skill, plugin or subagent definition is executing someone else’s prompt with your own credentials.

Step-by-step walkthrough2 variants · 12 steps

Attack

  1. Skills, plugins and subagent definitions install like packages — from registries anyone can publish to.
  2. What the user reviews is a name, a description and a star rating.
  3. What actually installs is a prompt. Installing an agent definition is executing someone else’s instructions.
  4. It loads above the user’s own text, in the most trusted position in the window.
  5. It inherits every tool the user has already granted. It never needed to ask.
  6. And it runs again every session, long after anyone remembers installing it.

Defended

  1. Same registry, same unreviewed publishers. That half does not change.
  2. A candidate is pinned to an exact version and hash. The thing you reviewed is the thing that loads.
  3. It is read like a dependency: what it instructs, what it can call, what it does on load.
  4. It loads as content the agent reasons about, not as a system instruction it must obey.
  5. And it does not inherit the user’s whole toolbox — a skill gets the scope its job needs.
  6. Its calls still cross the policy layer, so a compromised skill is contained, not catastrophic.
Key insight

A tool manifest is one line of untrusted text; a skill is a whole document that loads above the user’s own instructions and re-runs every session. Review it like a dependency, because that is exactly what it is.

Failure mode

Reviewing the listing instead of the payload. A name, a description and a star rating tell you nothing about the instructions that will load into the most trusted position in the window.

Further reading
RelatedTool poisoningPrivilege escalationGuardrail middleware

Elsewhere in the atlas

Harnesses →Evals →Context →Coding Agents →Tools →Ops →