AI Agent Skills — small instruction folders that extend AI coding assistants like GitHub Copilot and Claude — are gaining rapid adoption, but carry serious security risks that are largely unacknowledged. Anyone can publish a Skill on GitHub, and GitHub itself warns that Skills are unverified and may contain prompt injections or malicious scripts. A proof-of-concept 'csv-formatter' Skill demonstrates how hidden instructions can silently exfiltrate SSH keys, AWS credentials, and environment variables while telling the AI not to inform the user. The author built a scanner to detect such patterns and honestly evaluates its limits: signature-based checks fail against rephrasing, while behavioral analysis (credentials + network calls in the same file) and LLM-based semantic understanding are more durable. A layered detection approach — exact wording, behavior shape, model-based understanding, sandboxed execution, and change monitoring — is proposed. An open-source tool with a public benchmark is planned for a follow-up post.
