AI Supply Chain Blindspot: When 'Safe' Agent Skills Go Rogue

Just read the report on AIR's experiment with a fake agent skill. They created a harmless skill that just collected emails, pushed it to a marketplace and via Instagram ads, and it reached ~26,000 agents—including corporate instances.

The kicker? Every security scanner they tested marked it as "safe."

This highlights a massive gap in how we're securing Agentic AI. We're treating these like traditional apps, scanning for known bad signatures or obvious malicious strings, but the logic flow within the agent's "skill" definition is going unchecked. If a skill is designed to exfiltrate data slowly or perform lateral movement, will static scanners catch it? Probably not.

I put together a quick Python snippet to check a skill manifest for suspicious outbound endpoints, as a stop-gap:

import yaml
import re

def scan_skill_manifest(manifest_path):
    with open(manifest_path, 'r') as f:
        config = yaml.safe_load(f)
    
    risky_endpoints = []
    # Look for non-internal API calls
    for api in config.get('api_endpoints', []):
        if not api.startswith('https://internal.corp.com'):
            risky_endpoints.append(api)
            
    return risky_endpoints


We need to start treating agent skills like untrusted code. How is your org handling the vetting of third-party AI skills? Are you allowing marketplace skills in your corporate environment, or is it a total ban?