# Review agent skills and plugins as instructions, dependencies and delegated authority Canonical: https://www.web3sec.news/blog/agent-skills-plugin-review Author: Raiders (https://www.web3sec.news/about) Format: guide Topic: Skills & plugins Published: 2026-11-08 Updated: 2026-11-08 Inspect the whole instruction bundle, referenced resources and effective permissions before enabling a workflow extension or accepting its update. ## The short answer Review an agent skill or plugin before enabling it, including instructions, scripts, manifests, dependencies and remote resources. Compare requested actions with its advertised purpose and the permissions actually available. Pin reviewed versions where supported, test with dummy data and re-review updates; a text-only bundle can still redirect an agent’s powerful tools. ### Diagram: Trust the release path, not only the source. Protect the chain from reviewed change to the artifact receiving traffic. ![Protected source enters a least-privilege release workflow, produces a digest-identified artifact, and reaches production only after artifact verification. Untrusted pull requests use isolated checks without release credentials or write access.](https://www.web3sec.news/diagrams/software-release-trust.svg) [Full-size SVG](https://www.web3sec.news/diagrams/software-release-trust.svg) · [PNG download](https://www.web3sec.news/diagrams/software-release-trust.png) Original explanatory control model; not a reconstruction of private incident evidence. ## Identify the bundle and its effective capabilities Name an owner for the workflow extension and record its source, publisher, version, intended task and installation location. Distinguish an instruction bundle from a local server executable and from a hosted connector with account permissions. A plugin may combine several of those components. Review the effective result rather than assuming the label skill or plugin describes a universal security boundary across agent products. Anthropic’s skills documentation describes organized instructions, scripts and resources that an agent may load for specialized work. Its security guidance calls for reviewing bundled files and external dependencies. Use those documented mechanics as a concrete example, not a claim that every platform implements the same format. Determine how your agent discovers, prioritizes and updates the particular bundle before granting it access to real work. ## Trace instructions into data access and side effects Read the main instructions and every referenced file that can influence execution. List requested file reads, commands, downloads, uploads, external messages and changes to account settings. Compare each with the stated purpose. Pay attention to instructions that claim special authority, ask to suppress output, expand scope or send diagnostic material elsewhere. A legitimate-sounding quality check can still expose private documents if its destination is unreviewed. Inspect scripts, package manifests and templates as code where appropriate. Check interpolation of user-controlled values, credential handling and automatic dependency installation. For remote resources, record whether the content is versioned or can change without a local update. Review the actual host permissions and approval model separately: a manifest declaring benign intent does not constrain a process or connector unless the runtime enforces that restriction. ## Test behavior in a deliberately limited environment Use a synthetic workspace with dummy secrets, controlled destinations and no production-connected accounts. Exercise the ordinary workflow and the branches involving errors, missing dependencies or optional enhancements. Verify what files are opened, which processes execute and where network requests go. A happy-path demonstration can miss a fallback that downloads a new tool or uploads the workspace when a command fails. Test an unexpected request from a referenced document and confirm that it cannot grant new permissions or replace the task owner’s instructions. Keep consequential actions behind an independent approval boundary. Record the reviewed artifact, observed operations and justified exceptions. Do not treat the agent’s explanation that a bundle is safe as an independent audit of instructions the same agent is about to follow. ### Diagram: Content is evidence. Approval is authority. Keep source material separate from the authority to act. ![Sources enter a working context and produce a proposal. A separate approval gate checks scope before a tool action. Untrusted content cannot authorize execution.](https://www.web3sec.news/diagrams/trust-boundary.svg) [Full-size SVG](https://www.web3sec.news/diagrams/trust-boundary.svg) · [PNG download](https://www.web3sec.news/diagrams/trust-boundary.png) Original explanatory control model; not a reconstruction of private incident evidence. ## Control updates, removal and workflow residue Pin reviewed versions or snapshots where the platform supports it and inspect diffs before enabling meaningful updates. Recheck remote resources and dependencies that can change independently. Restrict who can install shared bundles or alter organization-wide discovery paths. Keep the previous reviewed copy so a new behavior can be compared with an actual artifact rather than a marketplace description that may also have changed. If a bundle behaves unexpectedly, disable it, preserve the relevant files and logs and inspect actions already performed through its workflow. Remove scheduled continuations and revoke any connector grants or credentials it created. Test removal with the same synthetic task before restoring a replacement. Closure requires understanding both the misleading instruction path and the authority that made its request effective. ## Controls to take away - Instructions can misuse tools without shipping their own executable code. - Remote resources can change the reviewed workflow independently. - Bundle review and runtime permission enforcement are complementary controls. ## Work through the boundary Local planning worksheets; they do not inspect or change accounts or environments. - [Prepare the research environment](https://www.web3sec.news/tools/research-preflight): Check authorization, source, credentials, egress and disposal for the actual lab boundary you will use. - [Build a permission review plan](https://www.web3sec.news/tools/agent-permissions): Select the capabilities you are considering and review approvals, revocation and evidence before connecting an agent. ## Working checklist Assign owners and record supporting evidence in your team's system. - [ ] Record publisher, version, purpose and effective runtime permissions. - [ ] Follow references beyond the main instruction file. - [ ] Review remote resources, scripts and installation/update behavior. - [ ] Exercise error branches with dummy files and controlled destinations. - [ ] Re-review changed artifacts and revoke workflow residue on removal. ## Common questions ### Can a skill be dangerous if it contains no executable script? Yes. Instructions can redirect an agent toward harmful tool use, sensitive file access or unintended uploads. Review what the bundle asks the agent to do, alongside the permissions of the agent that will follow it. ### Is reviewing the main instruction file enough? No. Follow references to scripts, templates, manifests, additional instruction files and remote resources. Check installation and update behavior because those paths can introduce code or instructions outside the main file. ### What should trigger another review? A new version, publisher, dependency, remote destination, tool set or permission request changes the trust decision. Keep the reviewed artifact and compare the actual update rather than relying on an unchanged name or description. ## Sources & further reading - [Anthropic: Agent Skills anatomy and referenced resources](https://www.anthropic.com/research/equipping-agents-for-the-real-world-with-agent-skills) - [Anthropic: skills overview and security considerations](https://platform.claude.com/docs/en/agents-and-tools/agent-skills/overview) Incident facts are attributed to the linked reports. Recommendations are Web3Sec's analysis. [Research methodology](https://www.web3sec.news/methodology) · [Editorial policy](https://www.web3sec.news/editorial-policy) · [Send a correction](https://www.web3sec.news/contact)