We Install AI Skills Too Casually

AI skills are spreading fast.

Anthropic introduced them. OpenAI adopted them. Developers publish them. Software vendors bundle them into plugins. Teams share them through repositories. Agents can even generate new skills from workflows that already worked.

Installation takes seconds. Review rarely does.

We've done this ourselves at REACHUM. We've installed useful-looking skills — including skills that invoke Python — without treating each installation as a software-security decision.

That needs to change.

A skill is more than a prompt

A skill gives an AI agent specialized instructions for completing a task: how to build a presentation, analyze a spreadsheet, update a website, manage a deployment.

But a skill can carry more than instructions. Under the open Agent Skills specification now used across Claude, Codex, and other platforms, a skill folder can include instructions, reference materials, templates and assets, and executable scripts.

Those scripts can run Python, JavaScript, shell commands, or calls to external tools. A malicious skill can contain malicious code. Even a legitimate one can introduce risk through careless programming, vulnerable dependencies, excessive permissions, or unexpected network activity.

Distribution creates a false sense of safety

Skills arrive through many channels: official collections, plugin directories, public repositories, consultants and vendors, coworkers, AI-generated recommendations, links shared in forums and social media.

The skill may look small. The description may sound useful. Installing one can feel more like adding a template than installing software.

That perception is dangerous. A skill downloaded from an unfamiliar repository deserves the same scrutiny as a browser extension, a software package, or a WordPress plugin. The source matters. The code matters. The permissions matter.

Malicious code is only part of the risk

A harmful skill doesn't need an obvious malware file. Its instructions alone can direct the agent to search for API keys or credentials, read files outside the intended project, upload proprietary material to an external service, download additional software, change security settings, request unnecessary permissions, or conceal actions inside a larger workflow.

A skill can also use prompt-injection techniques to persuade the agent into misusing tools it was already allowed to use.

Our standard

At REACHUM, we no longer treat skills as harmless conveniences. Before installing or using one, we ask:

• Who created it?
• Where did it come from?
• What instructions does it contain?
• Does it include executable code?
• Does it invoke Python, shell commands, installers, or external services?
• What files can it access?
• What network destinations can it reach?
• What credentials or environment variables can it read?
• Can it run automatically?
• What changed in its latest version?

The default is simple: inspect first, grant the minimum access, track what runs.

Vendors provide sandboxing, approval policies, filesystem limits, and network controls. Those guardrails only work when organizations keep them in place instead of approving every request out of habit. An unexplained request for broader access is a security event, not a routine interruption.

AI governance has moved past the model

Enterprise AI security used to focus on what people typed into a model and what the model returned.

Agents moved the boundary. They combine models, tools, files, connectors, memory, and reusable skills. They read, write, execute, publish, and communicate.

The governing question is no longer just “what did the model generate?” It now includes: what was the agent allowed to access, execute, change, and share?

Skills can turbocharge agent workflows, and they can also paralyze a business if users are not diligent.

That calls for a visible chain of control: who selected the skill, who reviewed it, what permissions it received, what it accessed, what it did, and whether the result can be audited.

That matters everywhere. It becomes critical in healthcare, life sciences, financial services, utilities, and other regulated environments.

AI skills make agents dramatically more useful. They also turn reusable prompts into an executable supply chain.

We've been casual about that distinction. We can't afford to stay that way.