- Installation is an action, not just a reading step.
- Treat paths, links, file types, and metadata as untrusted.
- Attribute a failure to the skill or the manager with evidence.
Before the agent reads a line
Importing a skill is a software operation. A manager may copy files, resolve paths, inspect version metadata, or synchronize a repository before the model sees SKILL.md. The skillctl security advisory documents flaws in one manager affecting some of these operations. They were patched in skillctl 0.1.3; the advisory is not a claim that every installer has the same defects.
Inventory bytes and file types
Compare the downloaded artifact with its marketplace preview. Enumerate files and reject unexpected special files, paths outside the intended root, and links that would import unrelated content. Treat untrusted package names, descriptions, and version references as data when they enter commands, logs, or commit messages.
Separate an unsafe carrier from an unsafe manager
A malicious instruction inside a skill may steer the agent after loading. A path traversal or file-copy bug can operate at installation even if the skill text is never obeyed. Log the artifact hash, manager version, destination, approval, and observed result so that a finding can be assigned to the correct boundary.
A controlled review exercise
Use a disposable directory and benign test fixtures to compare the intended install path with the actual files created. Do not run untrusted installer commands on a machine with real credentials. If a tool has a published security fix, check the exact affected and patched versions in its maintainer advisory before using it.
Sources & scope
This guide combines editorial explanation and practical review suggestions. Linked sources support the underlying concepts; this site has not independently replicated their experiments.
S45