XenonStack BlogAgent Skills Are the New Software Supply Chain: How to Govern What AI Agents Install

Why are AI agent skills a supply chain risk? An agent skill is a bundle of instructions, code and tool access that an agent loads and runs with its own permissions. Skills are shared and reused like software packages, they inherit whatever the agent can reach, and malicious intent can hide in a plain-language sentence that code scanners never check. The fix is a governed supply chain: a signed registry, a governed runtime and a decision ledger, working as one stack.

The 60-second brief

• Skills are executable. An agent skill is a bundle of instructions, code and tool access that an agent loads and runs with its own permissions.
• The registries are already poisoned. In early 2026, Snyk's ToxicSkills audit of 3,984 public skills found prompt injection in 36% of them and 76 confirmed malicious payloads.
• Your existing controls are blind. Code scanners check code. Skills attack through instructions and runtime behaviour.
• The fix is a governed supply chain: a signed registry, a governed runtime and a decision ledger, working as one stack.

In 2018, enterprises learned that npm install was a trust decision. In 2026, we are learning the same lesson again, only this time the package can think, act and hold your credentials.

Why Are Skills the New Software Supply Chain?

Two years ago, the question was which model to use. Today, the more important question is what your agents are allowed to do, and that is defined by skills.

A skill tells an agent how to complete a workflow: read the invoice, query the ERP, draft the reply, call the payment API. Skills are why agents became useful. They are also why agents became dangerous. Three properties make skills a supply chain, not a feature:

• They are shared and reused. Teams pull skills from public marketplaces, internal repos and vendor bundles, exactly as developers once pulled packages.
• They inherit the agent's permissions. A skill runs with whatever the agent can reach: files, credentials, email, databases, payment systems.
• They are written in natural language. Malicious intent can hide in a sentence, not just in code.

The evidence arrived fast. The OWASP Agentic Skills Top 10 records that ClawHub became the first agent registry to be poisoned at scale, with five of the top seven most-downloaded skills confirmed as malware at the peak. Snyk documented a fake "clawhub" CLI skill that dropped reverse shells after thousands of downloads. The Cloud Security Alliance counts up to 1,184 malicious skills uploaded in the ClawHavoc campaign alone.

A malicious package steals data. A malicious skill recruits your agent to do it for them, with your agent's credentials and your agent's authority.

In the past, the attacker had to get into your systems. Now, they only need to get into your agent's context.

How Does One Unsigned Skill Spread?

Most leaders picture a breach as a single event. A skill compromise is a chain, and each link looks legitimate on its own:

1. Publish. An attacker uploads a skill that looks useful, often impersonating a known brand or tool.
2. Install. A developer or business user adds it to an agent. No review, no scan, no signature check.
3. Inherit. The skill now runs with the agent's full permissions: files, secrets, email, APIs.
4. Execute. Hidden instructions tell the agent to read credentials, send data out or change records, while still doing the visible task.
5. Persist. The skill rewrites the agent's memory or instructions, so the behaviour survives even after the skill is deleted.
6. Spread. Other agents share the same skill library or memory, and the compromise travels with them.

Notice what is missing: no firewall was breached, no password was cracked. Every step was an authorised action by an authorised agent. That is why perimeter security does not see it, and why the control point has to be the supply chain itself.

Seven Best Practices for Governing Agent Skills

After working with enterprise teams deploying agents across BFSI, healthcare, government and industrial operations, these are the controls to put in place first.

1. Treat every skill install as a procurement decision. Adding a skill should go through the same review as adding a vendor: who wrote it, what it does, what it touches. No shadow installs.
2. Sign and pin everything. Every skill should carry a verifiable signature from a known publisher, pinned to a specific version. An unsigned or silently updated skill does not run.
3. Declare permissions up front, and grant the minimum. A skill must state which tools, data and systems it needs. The runtime grants exactly that, with scoped, short-lived credentials, never the developer's own access.
4. Scan intent, not just code. Pair static code scanning with checks on the natural-language instructions, looking for exfiltration, credential access and hidden directives.
5. Tier trust by risk. Not every skill needs the same scrutiny. A summarisation skill and a payments skill should not share an approval path.
6. Govern at runtime, not just at publish time. A skill that passed review can still be updated or fed poisoned context later. Policy has to be enforced every time it acts.
7. Keep a decision ledger. For every action, record which skill acted, under which version, with which context, under which policy and authority. When something goes wrong, you need to answer "why was this allowed?" in minutes, not weeks.

This mirrors the decision contract described in The Rollback Era: scope, authority, context, policy, evidence and reversibility. Skills are where that contract has to be enforced first.

The Governed AI Stack: ElixirHub, ElixirClaw and ElixirData

Best practices only work if they are built into the platform, not left to every team to remember. XenonStack built the skill supply chain as three layers that work together.

ElixirHub: the signed registry (what is allowed in)

• The supply chain for regulated AI agents: one governed catalogue for skills, connectors and other agent components.
• Every entry passes through publishing gates and is assigned a trust tier before any agent can use it.
• Signed provenance and version pinning, so you always know who published what, and nothing changes silently.

ElixirClaw: the governed runtime (how skills execute)

• The agentic OS where skills actually run, with policy-governed execution and human approval controls.
• Decision boundaries and four autonomy levels set per agent, domain and action.
• A prompt firewall for injection detection and PII redaction, plus zero-trust scoped tokens and isolation.
• Runs in managed cloud, your VPC or fully air-gapped.

ElixirData Context OS: the decision layer (what each action is allowed to decide)

• Governance compiled into the decision path, with policy checked before reasoning and before execution.
• An Agent Registry and scoped Agent Identity & Access for every agent.
• Decision Traces and an immutable Decision Ledger: the context used, the policy evaluated, the authority verified and the outcome.
• Trust graduation from Shadow to Supervised to Bounded to Full Autonomy.

How they work together: ElixirHub decides which skills may enter. ElixirClaw decides how they may run. ElixirData decides what each action may decide, and keeps the evidence. Outcomes and incidents flow back to tighten trust tiers and policies, so the supply chain gets safer every cycle.

How to Adopt: A 90-Day Roadmap

You do not need to stop agent adoption to get this right. You need to sequence it.

Days 0–30: See what you have

• Inventory every skill, MCP server and plugin in use, including shadow installs on developer machines.
• Rotate credentials that skills have touched, and remove standing secrets from skill files.
• Freeze new public-marketplace installs until a review path exists.

Days 31–60: Put in the gates

• Stand up a signed internal registry and move approved skills into it.
• Define trust tiers and the approval path for each, from low-risk to payment- or patient-affecting.
• Require declared permissions and scoped, short-lived credentials for every skill.

Days 61–90: Govern at runtime and prove it

• Turn on runtime policy enforcement and decision tracing for your highest-risk workflows first.
• Run a tabletop exercise: a trusted skill goes rogue. Measure how fast you detect, stop and explain it.
• Report to the board on coverage, not counts: share of agent actions running only signed, tiered, traced skills.

If you can only do one thing this quarter: make unsigned skills unable to run in production. Everything else builds on that.

Five Questions Every Board Should Ask

1. How many skills are our agents running today, and who approved each one?
2. Can any skill run in production without a verified signature?
3. Does each skill have its own scoped permissions, or does it inherit the agent's?
4. If a trusted skill turned malicious tomorrow, how quickly could we stop it everywhere?
5. Can we show a regulator exactly which skill took which action, and why it was allowed?

Executive Takeaways

• Skills are software with authority. Govern them like vendors, not like features.
• Unsigned means untrusted. Sign, pin and verify every skill before it runs.
• Least privilege per skill, never the agent's full access.
• Scan intent as well as code. The attack lives in the instructions.
• Tier trust by risk, so governance scales without slowing everything down.
• Govern at runtime. Publish-time review is necessary, not sufficient.
• Keep the decision ledger. Every action should be explainable in minutes.

The Bottom Line

We spent a decade learning to secure the software supply chain. We are now handing agents a new one, made of instructions, tools and credentials, and most enterprises have not signed a single link in it.

The winners in agentic AI will not be the companies with the most skills. They will be the companies that can prove which skills they trust, and why. The bottleneck is no longer capability. It is verification. Skills are where verification starts.

Govern Your Agent Skill Supply Chain

In a Context Workshop, XenonStack works with your security, platform and business owners to inventory the skills your agents run, define trust tiers and decision boundaries, and scope a signed registry and governed runtime on ElixirHub, ElixirClaw and ElixirData. Related reading: Harness Engineering for Enterprise AI.

Book a Context Workshop  |  Explore ElixirClaw Agentic OS

Frequently Asked Questions

What is an AI agent skill?

A skill is a packaged set of instructions, code and tool access that tells an agent how to complete a workflow. The agent loads it and runs it with the agent's own permissions.

Why don't existing security tools catch malicious skills?

Code scanners inspect code. Malicious skills often work through natural-language instructions and runtime behaviour, and every step is an authorised action by an authorised agent, so perimeter controls see nothing unusual.

What does signing and pinning a skill mean?

Signing attaches a verifiable signature from a known publisher. Pinning fixes the skill to a specific version. Together they ensure an unsigned or silently updated skill cannot run.

What is a decision ledger?

It is a record, for every agent action, of which skill acted, under which version, with which context, policy and authority. It lets an organisation explain why an action was allowed in minutes.

What is the first control to put in place?

Make unsigned skills unable to run in production. Inventory, trust tiers, scoped permissions and runtime enforcement all build on that.

Sources

• Snyk, ToxicSkills (February 2026)
• OWASP, Agentic Skills Top 10 (2026)
• Cloud Security Alliance, AI Agent Skill Trust Gap (June 2026)
• Snyk, clawhub malicious campaign (February 2026)

This article first appeared in Navdeep Singh Gill's LinkedIn newsletter, AI + Human = Human Squared.

Explore the XenonStack Platform and Agent Network

Platforms: ElixirData · ElixirClaw · ElixirHub · NexaStack · MetaSecure · Neural AI · AutonomousOps · CohortIQ · AI Aviator · SAIF Aviator

AI agents: AgentAnalyst · AgentEvaluation · AgentForce · AgentGRC · AgentHR · AgentInstruct · AgentLabel · AgentPixel · AgentQA · AgentRAI · AgentScrum · AgentSearch · AgentSketch · AgentSRE

XenonStack: xenonstack.com · xenonstack.ai · xenonstack.ae · xenonstack.jobs