agent-skills-platform

Least-privilege permissions

• Grant only necessary permissions: Each skill should receive the minimum access rights required to perform its job—like giving a cashier access only to the register, not the vault. Regularly audit and remove unused permissions.
• Use approval workflows: Require multiple sign-offs before deploying skills that access sensitive data or critical systems, preventing a single person from accidentally enabling a risky skill.
• Separate skill roles by function: Create different permission levels for skills that handle payments versus skills that generate reports, so one compromised skill cannot steal data meant for another function.
• Rotate and expire credentials: Skills that access databases or external services should use temporary access keys that automatically expire after a set period, limiting the window for abuse if stolen.

Network isolation

• Restrict skill communication: Configure network rules so skills can only connect to approved services and data sources, preventing them from reaching external cloud storage or attacker-controlled servers.
• Sandbox testing environments: Test all new or updated skills in a separate, isolated network before allowing them on production platforms—like a quarantine ward before releasing a package.
• Limit cross-platform data flow: Prevent skills on one of the 17 platforms from automatically sharing results or credentials with other platforms unless explicitly designed to do so.
• Monitor outbound connections: Track and log all network requests made by skills to detect unusual attempts to contact unknown external servers.

Monitoring

• Enable detailed audit logs: Record who deployed each skill, when it ran, what data it accessed, and what it output—create an unchangeable record of all skill activity.
• Alert on quarantine events: Set up automatic notifications when skills are quarantined, disabled, or rolled back so security teams can investigate immediately.
• Track skill dependencies: Document what other software or services each skill relies on and monitor when upstream dependencies receive security updates—a weakness in a dependency is a weakness in your skill.
• Measure unusual behavior: Watch for skills that suddenly consume excessive resources, access data they've never touched before, or fail repeatedly—signs of compromise or misconfiguration.

Red flags to watch for

• Unknown or unverified skill sources: Any skill arriving from an untrusted marketplace vendor or uploaded without clear documentation of who built it and what it does.
• Permissions mismatch: A skill requesting access to payment systems when its stated purpose is to generate employee schedules, or requesting broad "admin" rights instead of specific, limited access.
• Failed quarantine or rollback: A skill that was supposed to be disabled or removed is still executing, indicating the governance controls may not be working.
• Data in unexpected places: Skill outputs appearing in logs, error messages, or temporary files containing passwords, customer information, or financial data that should never leave secure storage.