The shift from “is this skill malicious?” to “does this skill have more permission than its job requires?” is the more important security model. A legitimate skill with unnecessary shell or credential access can become dangerous as soon as the agent processes untrusted input.
This is also where provenance and versioning become critical. In production AI work, including at IT Path Solutions, I’d want the skill version, upstream commit, effective permissions, and hardening changes tied to the agent run itself. Otherwise, when behavior changes, it’s difficult to tell whether the problem came from the model, the skill instructions, or a dependency update.
The other point worth emphasizing is that hardening and isolation solve different problems. Least privilege reduces blast radius, but it doesn’t make an agent safe to trust with arbitrary repositories. You still need execution boundaries, credential isolation, and an approval path for actions that cross those boundaries.
Agreed, and the run correlation point is the sharpest part of this. Right now the provenance stops at the artifact: upstream commit, hardening log, version tag, all in the OCI layer, none of it tied to the run that produced the weird output. That makes behavior drift hard to attribute.
Worth flagging that effective permissions do not exist as a field yet. A skill's real reach is whatever the agent grants plus whatever the instructions talk the model into. That is a gap to close rather than data to expose.
On isolation, same page. Hardening shrinks blast radius, it does not replace execution boundaries or an approval path.
The shift from “is this skill malicious?” to “does this skill have more permission than its job requires?” is the more important security model. A legitimate skill with unnecessary shell or credential access can become dangerous as soon as the agent processes untrusted input.
This is also where provenance and versioning become critical. In production AI work, including at IT Path Solutions, I’d want the skill version, upstream commit, effective permissions, and hardening changes tied to the agent run itself. Otherwise, when behavior changes, it’s difficult to tell whether the problem came from the model, the skill instructions, or a dependency update.
The other point worth emphasizing is that hardening and isolation solve different problems. Least privilege reduces blast radius, but it doesn’t make an agent safe to trust with arbitrary repositories. You still need execution boundaries, credential isolation, and an approval path for actions that cross those boundaries.