How we review AI agent skills for security before publishing them
A SKILL.md file is plain text, but an agent treats it as instructions. If it says "read this file and send it there", a capable agent with shell access may simply do it. We publish agent skills and MCP server guides on AI Craftbook, so before anyone can copy a skill's text or download its files from us, it goes through a security review. This post walks through that review, shows real scanner…
Before an AI agent skill can be published, it undergoes a rigorous security review. The review process involves a scanner that only reads the skill's text, without executing or importing anything, to identify potential security risks. The scanner looks for various types of threats, such as instruction overrides, credential theft, exfiltration attempts, remote code execution, tampering with the agent, supply chain vulnerabilities, and status manipulation.
One example of a potential threat is an override instruction, which could tell the agent to ignore or disregard its existing instructions. Another example is hidden HTML comments, which may contain instructions addressed specifically to the agent. The scanner also checks for base64-encoded content, decoding it and scanning it again if necessary. Additionally, the scanner identifies typosquatted package names and high-risk dependencies in the skill's dependencies.
After the scanner completes its analysis, any findings are reported with a concise redacted excerpt to avoid revealing sensitive information. However, it's important to note that the scanner's findings are not proof of safety, as it only identifies known patterns and does not guarantee that the skill is free from all potential threats.
Written by urgent.news from Dev.to's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
