Auditing Agent Skills: A Threat Model for the Next Generation of AI Package Managers
A developer built a fake AI skill called 'csv-formatter' to demonstrate the security risks of the emerging 'Agent Skill' ecosystem, where AI assistants can install unverified skills from GitHub. The skill contained hidde…