agent-skills

Least-privilege permissions

• Restrict agent skill execution to isolated sandbox environments with minimal filesystem access; deny write permissions outside designated work directories
• Use capability-based security (e.g., allowlists for specific commands); never grant unrestricted shell or sudo access
• Implement package manager restrictions: disable network access during npm install/pip install or use pre-cached, vetted dependency sets
• Run agent processes under dedicated low-privilege service accounts with no access to production secrets or system configuration files

Network isolation

• Execute skills in network-sandboxed containers with outbound traffic blocked by default; only permit HTTPS to explicitly whitelisted domains
• Require manual approval and audit logging for any skill-initiated external API calls; disable DNS resolution for unverified services
• Use authenticated, encrypted channels (mTLS) for communication between agent and skill runners; validate server certificates
• Prevent direct agent access to internal services (databases, message queues); route through narrow API gateways with request validation

Monitoring

• Log all skill invocations with inputs, outputs, and execution time; flag anomalies (unusual runtime, repeated failures, or high resource usage)
• Implement real-time detection of credential patterns (API keys, connection strings) in logs; alert and block on detection
• Monitor filesystem and process execution for suspicious activity (binary downloads, shell escapes, parent-directory traversal attempts)
• Track dependency versions in lock files across deployments; trigger alerts on unexpected transitive dependency changes or known CVEs

Red flags to watch for

• Agents attempting to modify their own skill definitions, sandboxing rules, or logging configuration
• User prompts containing shell metacharacters, path traversal sequences (../), or encoded payloads; reject or sanitize aggressively
• Skills invoking external package managers, downloaders, or code evaluation functions (e.g., eval, exec, compile) without explicit allowlisting
• Skill outputs containing unencrypted secrets, exfiltration attempts to unexpected domains, or requests for elevated permissions mid-execution