A couple of weeks ago I wrote about the risk hiding inside AI Agent Skills, the small instruction folders that Claude, GitHub Copilot, and other agents now install like packages, and the fake malicious skill I built to prove that risk was real (full piece here if you want the background). That post was the problem statement, a threat model, and a proof of concept.
This post is the framework. Since then I've actually built the thing out, agent-skills-guard, and along the way I found the real edges of what it can and can't do. Here's each open challenge, and exactly what in the framework answers it now, tested with real output rather than claims.
Challenge 1: the trap can hide in the field that decides whether the skill even runs
A Skill's description isn't just a label. It's the one piece of text an agent reads for every installed skill, every session, before it decides anything else. If an attacker can slip an instruction in there, the agent never needs to open a script or a reference file at all. It just needs to glance at the catalog.
So I built a test case where the entire trap lives in the description field and nowhere else:
