Agent skill governance: how to control what your agents install
Verified August 25, 2026. General information, not legal advice.
An agent skill is a bundle of instructions and code your AI agent loads and runs with its own privileges. Governing skills means six controls working as one lifecycle: inventory, scanning, executed evals, gated promotion, version pinning, and retraction, the ability to take a skill back from every machine it reached. The first five are documented somewhere in most frameworks. The sixth is where the frameworks go quiet, and where incidents become breaches.
The six controls, in lifecycle order
A record of every skill on every agent surface: name, version, source, and who approved it. You cannot govern what you cannot list, and most organizations cannot list theirs.
Pattern checks for the flaw classes the research keeps finding: prompt injection language, exfiltration phrasing, shell commands piped to installers, hardcoded secrets, and attempts to read credential files.
A declared evaluation that actually ran, verified against the exact content hash that was approved. An eval that exists but never executed is documentation, not a control.
Skills earn trust in scopes: personal, then team, then company. Each promotion requires a named owner, a clean scan, executed evals, and at company scope a second reviewer who is not the author.
The approved version is pinned by content hash, and any later change is detected. Approval attaches to exact content, never to a skill's name, because names do not change when code does.
Removing a skill from every machine it already reached. This is only possible when deliveries were recorded at install time. It is the least specified problem in the published frameworks, and the one that matters most the day a skill turns hostile.
Which control closes which risk
The taxonomy tells you what can go wrong. The lifecycle tells you what to do. This is the map between them, including the one risk a lifecycle cannot reach.
| OWASP risk | Closed by |
|---|---|
| AST01 Malicious skills | Static scanning, then executed evals, then gated promotion. Three passes because scanning alone misses behaviour that only appears when the skill runs. |
| AST02 Supply chain compromise | Inventory and provenance, plus pinning. You cannot reason about a dependency you never recorded. |
| AST03 Over-privileged skills | Static scanning for the capability request, gated promotion for the human who has to agree it is warranted. |
| AST04 Insecure metadata | Static scanning. Metadata is the part a marketplace renders and a reviewer skims. |
| AST05 Untrusted external instructions | Static scanning catches the fetch. What the fetched text then says is a runtime problem, so treat this as reduced, not closed. |
| AST06 Weak isolation | NOT CLOSED by any lifecycle control. Isolation is granted by the agent host at run time. A governed skill running unsandboxed is still a governed skill running unsandboxed. |
| AST07 Update drift | Pinning and drift detection. This is the risk that makes a one-time review worthless. |
| AST08 Poor scanning | Executed evals. The answer to a scanner that passes everything is a test that has to actually run. |
| AST09 No governance | Gated promotion and inventory together. This is the whole lifecycle, named as a risk. |
| AST10 Cross-platform reuse | Inventory and provenance to know where a skill went, retraction to pull it back from each surface it reached. |
Why this is not theoretical
In February 2026, Snyk published ToxicSkills, the first large security audit of the agent skills ecosystem. Scanning 3,984 skills from two public marketplaces, its researchers found at least one security flaw in 1,467 skills (36.82%), at least one critical issue in 534 (13.4%), and 76 confirmed malicious payloads built for credential theft, backdoors, and data exfiltration. Eight of those malicious skills were still publicly listed on the day of publication. One marketplace’s entire publishing bar was a skill file and a one week old GitHub account.
The risk taxonomy is catching up. The OWASP Agentic Skills Top 10, an OWASP incubator project in active development, names the ten risk classes specific to skills: malicious skills, supply chain compromise, over-privileged skills, insecure metadata, untrusted external instructions, weak isolation, update drift, poor scanning, no governance, and cross-platform reuse. It is an early stage community project rather than an established standard, and it is still the most focused public map of the problem.
What the frameworks give you, and what they leave to you
IMDA’s Model AI Governance Framework for Agentic AI, launched at the World Economic Forum in Davos in January 2026 and now at version 1.5, is the most complete public framework for governing agents: bound the risks upfront, make humans meaningfully accountable, implement technical controls, enable end user responsibility. Its control objectives cover agent identity, logging, and bounded autonomy. What it and its peers leave to the implementer is the mechanics of the skill lifecycle itself: who may promote a skill to company scope, how an approved version is pinned, and how a delivered skill is removed from the machines it reached.
One working answer to that gap is SKM, GAGE’s own open source reference implementation. Skills move through personal, team, and company scopes; promotion is gated on security scans, evals verified as actually executed against the approved content hash, and a second reviewer at company scope; every delivery to an agent surface is recorded; and retraction removes a delivered skill from exactly the paths it placed, and nothing else. SKM is a reference implementation, MIT licensed and dependency free. It is not a standard, and no other organization has adopted it. We publish it because the retraction problem needs working code in public, not another whitepaper.
This lifecycle is taught end to end in Agentic AI Governance: Applied Mastery, which engages the OWASP Agentic Skills Top 10 across 40 of its 99 topics and builds to a conformance dossier you defend against red team review.
What is an AI agent skill?
A packaged set of instructions, and often code, that an AI agent loads to gain a capability: reading a file format, calling an API, running a workflow. The critical property is that a skill executes with the agent's own privileges, which can include shell access, the file system, credentials, and messaging. Installing a skill is closer to hiring than to downloading a document.
Why do agent skills need their own governance?
Because the marketplace bar is near zero and the privilege level is near total. When Snyk's researchers scanned 3,984 skills from two public marketplaces for the February 2026 ToxicSkills audit, they found at least one security flaw in 1,467 of them (36.82%) and at least one critical issue in 534 (13.4%). One marketplace required only a skill file and a one week old GitHub account to publish, with no review and no sandbox.
What is the OWASP Agentic Skills Top 10?
An OWASP incubator project, in active development, that names the ten risk classes specific to agent skills, from malicious skills and supply chain compromise at the top to cross-platform reuse at the tail. It is an early stage community project, not an established standard, and it is the most focused public taxonomy of the problem that exists today.
What is retraction, and why is it the hard part?
Retraction is removing a skill from the machines it already reached after distribution. Frameworks such as IMDA's Model AI Governance Framework for Agentic AI define control objectives: identity, logging, accountability, bounded autonomy. The mechanics of taking a capability back once it is installed on dozens of laptops are left to the implementer. Retraction only works when every delivery was recorded, so the removal tool knows exactly which paths it placed and touches nothing else.
What is SKM?
SKM is GAGE's own open source reference implementation of this lifecycle, MIT licensed and written in dependency free Python. It moves skills through personal, team, and company scopes with promotion gates on scans and executed evals, pins approved versions by hash, detects drift, records every delivery to an agent surface, and retracts delivered skills from the machines that received them. It is a working reference, not a standard, and no other organization has adopted it.
Is a skill scanner enough on its own?
No. Scanning catches known flaw patterns at a moment in time; it says nothing about who approved the skill, which version is actually installed, whether the content changed after approval, or how to remove it. Scanning is one control in a lifecycle. The ToxicSkills authors make the same point from the other direction: 91% of the malicious skills they confirmed combined prompt injection with traditional malware, a pairing built to defeat single layer checks.
Govern the agent, not just the model
99 topics, a mastery exam, and a verifiable credential in agentic AI governance.
Sources
- OWASP Agentic Skills Top 10, an OWASP incubator project, version 1.0 targeted for late 2026, owasp.org/www-project-agentic-skills-top-10.
- Snyk, “ToxicSkills” research, published February 5, 2026, snyk.io: 3,984 skills scanned from the ClawHub and skills.sh marketplaces; 1,467 (36.82%) with at least one security flaw; 534 (13.4%) with at least one critical issue; 76 confirmed malicious payloads, 8 still listed at publication.
- IMDA, Model AI Governance Framework for Agentic AI, launched at the World Economic Forum, Davos, January 2026; version 1.5, May 2026, imda.gov.sg.
- SKM, an open source skill lifecycle manager (MIT license), github.com/DownByBracket/skm.
Verified August 25, 2026. GAGE is not affiliated with, or endorsed by, OWASP, Snyk, or IMDA. SKM is a GAGE open source project. General information, not legal advice.