Identify the bundle and its effective capabilities
Name an owner for the workflow extension and record its source, publisher, version, intended task and installation location. Distinguish an instruction bundle from a local server executable and from a hosted connector with account permissions. A plugin may combine several of those components. Review the effective result rather than assuming the label skill or plugin describes a universal security boundary across agent products.
Anthropic’s skills documentation describes organized instructions, scripts and resources that an agent may load for specialized work. Its security guidance calls for reviewing bundled files and external dependencies. Use those documented mechanics as a concrete example, not a claim that every platform implements the same format. Determine how your agent discovers, prioritizes and updates the particular bundle before granting it access to real work.
Trace instructions into data access and side effects
Read the main instructions and every referenced file that can influence execution. List requested file reads, commands, downloads, uploads, external messages and changes to account settings. Compare each with the stated purpose. Pay attention to instructions that claim special authority, ask to suppress output, expand scope or send diagnostic material elsewhere. A legitimate-sounding quality check can still expose private documents if its destination is unreviewed.
Inspect scripts, package manifests and templates as code where appropriate. Check interpolation of user-controlled values, credential handling and automatic dependency installation. For remote resources, record whether the content is versioned or can change without a local update. Review the actual host permissions and approval model separately: a manifest declaring benign intent does not constrain a process or connector unless the runtime enforces that restriction.
Test behavior in a deliberately limited environment
Use a synthetic workspace with dummy secrets, controlled destinations and no production-connected accounts. Exercise the ordinary workflow and the branches involving errors, missing dependencies or optional enhancements. Verify what files are opened, which processes execute and where network requests go. A happy-path demonstration can miss a fallback that downloads a new tool or uploads the workspace when a command fails.
Test an unexpected request from a referenced document and confirm that it cannot grant new permissions or replace the task owner’s instructions. Keep consequential actions behind an independent approval boundary. Record the reviewed artifact, observed operations and justified exceptions. Do not treat the agent’s explanation that a bundle is safe as an independent audit of instructions the same agent is about to follow.
Keep source material separate from the authority to act.
Original Web3Sec diagram. On small screens, scroll the figure or open the full-size version.
Control updates, removal and workflow residue
Pin reviewed versions or snapshots where the platform supports it and inspect diffs before enabling meaningful updates. Recheck remote resources and dependencies that can change independently. Restrict who can install shared bundles or alter organization-wide discovery paths. Keep the previous reviewed copy so a new behavior can be compared with an actual artifact rather than a marketplace description that may also have changed.
If a bundle behaves unexpectedly, disable it, preserve the relevant files and logs and inspect actions already performed through its workflow. Remove scheduled continuations and revoke any connector grants or credentials it created. Test removal with the same synthetic task before restoring a replacement. Closure requires understanding both the misleading instruction path and the authority that made its request effective.
Controls to take away
- Instructions can misuse tools without shipping their own executable code.
- Remote resources can change the reviewed workflow independently.
- Bundle review and runtime permission enforcement are complementary controls.
Work through the boundary.
These local worksheets turn the review questions into a plan. They do not inspect or change the actual account or environment.
Prepare the research environment ↗
Check authorization, source, credentials, egress and disposal for the actual lab boundary you will use.
Build a permission review plan ↗
Select the capabilities you are considering and review approvals, revocation and evidence before connecting an agent.
Take this to your next review
Working checklist
Use this as a starting point, then assign owners and record evidence in your team's own system. Checks here reset when you leave or reload this note.
0 of 5 reviewed
Common questions
Can a skill be dangerous if it contains no executable script?
Yes. Instructions can redirect an agent toward harmful tool use, sensitive file access or unintended uploads. Review what the bundle asks the agent to do, alongside the permissions of the agent that will follow it.
Is reviewing the main instruction file enough?
No. Follow references to scripts, templates, manifests, additional instruction files and remote resources. Check installation and update behavior because those paths can introduce code or instructions outside the main file.
What should trigger another review?
A new version, publisher, dependency, remote destination, tool set or permission request changes the trust decision. Keep the reviewed artifact and compare the actual update rather than relying on an unchanged name or description.
Sources & further reading
The references below support this note. Adapt the procedures to your systems, access model and recovery requirements.
A correction or a better primary source? Send Raiders the article URL and evidence. Editorial policy.