> For the complete documentation index, see [llms.txt](https://handbook.harmonic.security/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://handbook.harmonic.security/handbook/2.-supply-chain-and-extensibility/2.4-analyzing-skills-for-risk.md). # 2.4 Analyzing skills for risk Skills and instruction bundles can encode trusted behavior — how to review the full package, dependencies, permissions, and sharing path before use. *Last reviewed: August 18, 2026* {% hint style="info" %} A skill is instruction that loads on demand. Review the instruction file, the supporting files, the scripts, and the sharing path before treating it as trusted. {% endhint %} ## Analyzing skills for risk: what security teams need to know Skills package repeatable instructions and resources so an agent can perform a task more reliably. That makes them useful for teams, but it also makes them a supply-chain object. The main risk is that a skill can shape the agent's behavior when the user is focused on the task, not the trust boundary. Supporting files and scripts raise the stakes because the risky content may not sit in the top-level instruction file. ## Common analyzing skills for risk security failures * A reviewer reads SKILL.md but misses scripts or templates in the same directory. * A broad skill description makes the skill activate during unrelated tasks. * A user-shared skill becomes an unreviewed team standard. * A plugin bundles a skill and a hook, but only the skill text is reviewed. * Skill authors can pre-approve tools without a security review. ## Analyzing skills for risk security controls checklist * Review the full skill directory, including scripts, examples, templates, and references. * Require owner, source, version, purpose, activation description, and review date. * Restrict who can publish skills to team or organization scopes. * Block or review pre-approved tool access inside skills. * Test skill activation with safe prompts and abuse prompts before approval. ## Anthropic ### Overview Anthropic's skill surface is Agent Skills. A skill is an organized folder of instructions, scripts, and resources; in Claude Code it is a SKILL.md file with frontmatter that can include supporting files, dynamic context, and pre-approved tools, scoped as personal, project, enterprise, or plugin-provided. Cowork can use skills and plugins across desktop, web, and mobile remote sessions, while local components still require the desktop app. On the API, skills execute through the code execution environment, can be pinned to specific versions, and require the relevant beta headers. Anthropic publishes enterprise guidance for exactly this review: check scripts, adversarial instructions, MCP references, network access, hardcoded credentials, filesystem scope, and tool invocations before deployment. Enterprise custom roles can control whether users have the skills capability at all, and pre-approved tool access inside a skill deserves the same scrutiny as a permission rule. Treat plugin-delivered skills as part of plugin review (see 2.5). Claude Tag channel behavior can include standing instructions and plugins in addition to channel memory. Review those instructions and plugin contents before attaching broad Access bundles, because everyone in the channel receives the same agent capabilities even when different people initiate the work. ### Anthropic documentation * [Skills for enterprise](https://platform.claude.com/docs/en/agents-and-tools/agent-skills/enterprise) * [Using Agent Skills with the API](https://platform.claude.com/docs/en/build-with-claude/skills-guide) * [Claude Code skills](https://code.claude.com/docs/en/skills) * [Claude Code plugins](https://code.claude.com/docs/en/plugins) * [Claude Code settings](https://code.claude.com/docs/en/settings) * [Manage custom roles on Enterprise plans](https://support.claude.com/en/articles/13930452-manage-custom-roles-on-enterprise-plans) * [Use Claude Cowork on web, desktop, and mobile](https://support.claude.com/en/articles/15520349-use-claude-cowork-on-web-desktop-and-mobile) * [How Claude Tag agent identity works](https://claude.com/docs/claude-tag/concepts/agent-identity) ### Applicable Harmonic guides for Anthropic * [Securing Claude Cowork: A Security Practitioner's Guide](https://www.harmonic.security/resources/securing-claude-cowork-a-security-practitioners-guide) ## OpenAI ### Overview OpenAI skills can run in ChatGPT Work and Codex. They are reusable instructions with optional references and helper scripts, often delivered inside plugins. The Plugin Directory spans Work on the web, Work or Codex in the ChatGPT desktop app, and supported Codex clients. Review a bundled skill with the plugin that carries it, and remember that skill files can point at scripts the top-level instructions never mention. Codex granular approval policies include skill approvals, so approval policy is part of the skill control set, and managed configuration can constrain what users are able to weaken. In ChatGPT managed workspaces, RBAC permissions include skills, so role design decides who can use them. Keep skill review separate from app review: an app grants access to a system, while a skill shapes agent behavior, and one plugin can carry both. ### OpenAI documentation * [Codex skills](https://developers.openai.com/codex/skills) * [Plugins in ChatGPT and Codex](https://help.openai.com/en/articles/20001256) * [Plugins](https://learn.chatgpt.com/docs/plugins) * [Agent approvals and security](https://developers.openai.com/codex/agent-approvals-security) * [Codex managed configuration](https://developers.openai.com/codex/enterprise/managed-configuration) * [RBAC](https://help.openai.com/en/articles/11750701-rbac) ### Applicable Harmonic guides for OpenAI * [Securing Codex Best Practice](https://www.harmonic.security/resources/securing-codex-best-practice) ## Frequently asked questions about analyzing skills for risk ### What is an AI skill? A skill is a packaged set of instructions and optional supporting files that an AI agent loads when a task matches its description or when a user invokes it. Anthropic's Agent Skills use a SKILL.md file with frontmatter plus scripts and resources; Codex skills are reusable instructions with optional references and helper scripts, often distributed inside plugins. Either way, a skill is supply-chain content that shapes agent behavior on demand. ### Why are AI skills a security risk? A skill activates while the user is focused on the task, not the trust boundary, and it can carry more than instructions: bundled scripts, templates, references to MCP tools, and on some platforms pre-approved tool access. Review skills as both code and prompt material, because the risky content often sits in the supporting files rather than the top-level instruction text. ### What should a skill review include? The full skill directory: the instruction file, every script and template, tool permissions or pre-approvals, activation language, network access, hardcoded credentials, and filesystem scope, plus the owner, source, and sharing scope. Anthropic's enterprise skill guidance lists this same review surface, including adversarial instructions and MCP references. ### Who should be allowed to publish skills? Restrict team- and organization-wide publishing to a reviewed author group, and gate the capability itself where the platform allows it: Claude Enterprise custom roles can control skill creation and sharing, and ChatGPT RBAC includes a skills permission. Personal skills can stay open for low-risk experimentation as long as they cannot reach production groups unreviewed. ### How should skills be monitored? Track creation, updates, activation, tool use, and sharing events wherever the platform exposes them, and treat a skill update as a new skill for review purposes. For plugin-delivered skills, monitor the plugin version too: an update can swap a skill's contents without the name changing. ## Applicable regulations and frameworks | Governance page | Relationship to this article | | --------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------- | | G.1 Map your controls to NIST AI RMF and CSF 2.0 | This article supplies implementation evidence for the NIST AI RMF and matching NIST CSF 2.0 outcomes. | | G.3 DORA and AI resilience in financial services | Conditional: for a DORA-regulated workflow, this supports ICT asset, dependency, and third-party risk management. | | G.6 Write an AI Acceptable Use Policy that holds up | This article supplies a technical or process control used to enforce the acceptable-use policy. | | G.7 Ownership and RACI for AI security | This control depends on the ownership and evidence responsibilities defined in the RACI. | *G.2, G.3, G.4, and G.9 are conditional mappings. They apply only when the deployment is within the legal or regulatory scope described on the linked governance page.* ## Related handbook guidance * [2. Supply Chain & Extensibility](/handbook/2.-supply-chain-and-extensibility.md) * [2.5 Plugins and marketplaces](/handbook/2.-supply-chain-and-extensibility/2.5-plugins-and-marketplaces.md) * [2.7 The supply-chain review workflow](/handbook/2.-supply-chain-and-extensibility/2.7-the-supply-chain-review-workflow.md) * [5.3 Supply chain attacks and notable CVEs](/handbook/5.-threats-and-adversarial/5.3-supply-chain-attacks-and-notable-cves.md) * [4.7 Secrets and credential hygiene in prompts and tools](/handbook/4.-data-protection-and-residency/4.7-secrets-and-credential-hygiene-in-prompts-and-tools.md) --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://handbook.harmonic.security/handbook/2.-supply-chain-and-extensibility/2.4-analyzing-skills-for-risk.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.