SAgent Skill Guard

THREAT MODEL

Agent Skill security starts before activation.

Skills are executable influence: they can guide tool choice, file access, network calls, edits, and approval behavior. Review them like code and policy combined.

Authority attacks

Reject instructions that claim higher priority, ignore user or system rules, suppress approvals, conceal actions, or redefine the task beyond the user's request.

Credential and data access

Question broad searches of home directories, SSH material, browser state, cloud credentials, environment files, logs, or unrelated repositories. Require a task-specific reason and explicit scope.

Remote execution

Inspect every URL, installer, package, script, binary asset, and dynamic download. Never execute a network response directly. Pin reviewed versions or commits and record provenance.

Allowed tools

Read-only tools can still expose sensitive data. Write, shell, browser, messaging, deployment, and computer-control tools add consequential side effects. Request only what the workflow actually needs.

Update drift

Re-review diffs when a skill changes. A previously trusted name can gain new scripts, permissions, activation triggers, or data destinations after installation.