Installing an AI skill can give an agent new instructions, scripts and dependencies that operate with its existing access. Microsoft’s Agent Skills guidance recommends reviewing these packages like other third-party code before deployment.
Start with provenance: identify the maintainer and original repository, check the package name, and record the exact commit or release you reviewed. Keep that version fixed until an update has passed the same checks.
Read SKILL.md alongside every referenced script and installation step. Look for unexplained downloads, new dependencies, access to credentials, broad file writes and outbound destinations. Compare what the package actually does with its advertised purpose.
Test a copy in a disposable sandbox using synthetic files and dummy credentials. Restrict filesystem access and network egress to the paths and destinations the task requires. Log loaded resources and executed scripts, then review unexpected activity before enabling the skill in a working environment.
Use automated scanning as supporting evidence. Unit 42 notes that static analysis can miss dynamic behavior and obfuscated payloads. A clean result or a reassuring model response should not replace code review and observed behavior. Recheck permissions, dependencies and version changes whenever you update.
For a client-specific enforcement example, see DaySec’s Claude Code permissions and sandboxing guide.
Image: Wiz Research. The diagram shows general AI pipeline risks for context; this guide focuses on installing agent skills.
