AID-H-030: Agentic Skill Admission Security Analysis & Control Pipeline
Why skills need dedicated admission analysis: Skills are hybrid artifacts simultaneously containing executable code (shell scripts, Python calls), structured configuration (YAML frontmatter, JSON manifests, dependency files), natural-language behavioral instructions (Markdown prose directing agent actions), and self-declared metadata (name, author, permissions, risk tier) - no single scanning approach can adequately assess the security posture of such a composite artifact. The Snyk ToxicSkills research (February 2026) confirmed that malicious skills commonly combined both the code and natural language instruction layers as attack vectors, with pattern-matching scanners missing threats expressed entirely in prose.
Pipeline stages:
- AID-H-030.004 - Safe skill parsing & loader hardening
- AID-H-030.001 - Metadata honesty validation
- AID-H-030.002 - Instruction-layer semantic intent analysis
- AID-H-030.003 - Manifest-vs-observed behavioral consistency testing
- AID-H-030.005 - Admission policy orchestration & continuous re-scan governance
Scope boundary
Owns the skill-specific admission pipeline that parses composite skill artifacts, evaluates metadata honesty and instruction intent, compares declared and observed behavior, and fuses exact stage evidence into a block, review, or allow decision. It orchestrates but does not reimplement generic scanners, publisher controls, capability enforcement, or sandboxes.
AID-H-031: AID-H-030 admits third-party or externally sourced agentic skill packages; AID-H-031 governs internally AI-generated or AI-materially-modified development changes through the organization's SDLC. Both use staged evidence, but their artifact trust models and promotion destinations differ.
AID-H-018.007: AID-H-030 decides whether a skill artifact may be installed based on its declared and observed behavior; AID-H-018.007 defines and enforces the approved capability manifest at runtime. Admission of a skill does not grant its requested capabilities.
AID-I-001.005: AID-H-030 supplies skill-specific scenarios, manifest comparison, and the final admission policy; AID-I-001.005 owns generic isolated behavioral execution, observation completeness, teardown proof, and the attested report. A clean sandbox report is one admission input rather than installation authorization.
Sub-techniques
- AID-H-030.001: Skill Metadata & Manifest Honesty Validation
- AID-H-030.002: Instruction-Layer Semantic Security Analysis
- AID-H-030.003: Manifest-vs-Observed Behavioral Consistency Testing
- AID-H-030.004: Safe Skill Parsing & Loader Hardening
- AID-H-030.005: Admission Decision Orchestration & Triggered Revalidation
Threat mappings
MITRE ATLAS
- AML.T0010 AI Supply Chain Compromise
- AML.T0010.005 AI Supply Chain Compromise: AI Agent Tool
- AML.T0011 User Execution
- AML.T0011.001 User Execution: Malicious Package
- AML.T0011.002 User Execution: Poisoned AI Agent Tool
- AML.T0050 Command and Scripting Interpreter
- AML.T0060 Publish Hallucinated Entities
- AML.T0072 Cyber Communication Channel
- AML.T0074 Masquerading
- AML.T0109 AI Supply Chain Rug Pull
- AML.T0110 AI Agent Tool Poisoning
- AML.T0110.000 AI Agent Tool Poisoning: Definition and Instructions
- AML.T0110.001 AI Agent Tool Poisoning: Implementation
- AML.T0111 AI Supply Chain Reputation Inflation
- AML.T0115 Publish Poisoned AI Artifacts
- AML.T0115.002 Publish Poisoned AI Artifacts: AI Agent Tools
- AML.T0119 Exploit Automated Artifact Processing Pipeline
MAESTRO
- Input Validation Attacks (L3)
- Agent Tool Misuse (L7)
- Compromised Agent Registry (L7)
- Supply Chain Attacks (Cross-Layer)
OWASP LLM Top 10 2026
- LLM01:2026 Prompt Injection
- LLM03:2026 Excessive Agency
OWASP ML Top 10 2023
- ML06:2023 AI Supply Chain Attacks
OWASP Top 10 for Agentic Applications 2026
- ASI01:2026 Agent Goal Hijack
- ASI04:2026 Agentic Supply Chain Vulnerabilities
- ASI05:2026 Unexpected Code Execution (RCE)
NIST Adversarial Machine Learning 2025
- NISTAML.039 Compromising connected resources
Cisco Integrated AI Security and Safety Framework
- AITech-1.2 Indirect Prompt Injection
- AITech-2.1 Excessive Agency
- AITech-5.1 Memory System Persistence
- AITech-5.2 Configuration Persistence
- AITech-8.2 Data Exfiltration / Exposure
- AITech-9.2 Detection Evasion
- AITech-9.3 Dependency / Plugin Compromise
- AITech-11.1 Environment-Aware Evasion
- AITech-12.1 Tool Exploitation
- AITech-13.1 Disruption of Availability
- AISubtech-2.1.2 Capability and Permission Overreach
- AISubtech-5.1.1 Long-term / Short-term Memory Injection
- AISubtech-5.2.1 Agent Profile Tampering
- AISubtech-8.2.3 Data Exfiltration via Agent Tooling
- AISubtech-9.3.1 Malicious Package / Tool Injection
- AISubtech-9.3.2 Dependency Name Squatting (Tools / Servers)
- AISubtech-9.3.3 Dependency Replacement / Rug Pull
- AISubtech-11.1.3 Environment-Scoped Payloads
- AISubtech-12.1.3 Unsafe System / Browser / File Execution
- AISubtech-13.1.1 Compute Exhaustion
- AISubtech-13.1.2 Memory Flooding
- AISubtech-13.1.4 Application Denial of Service
- AISubtech-14.1.2 Insufficient Access Controls
Google Secure AI Framework 2.0 - Risks
- IIC: Insecure Integrated Component
- RA: Rogue Actions
Databricks AI Security Framework 3.0
- Agents - Core 13.2: Tool Misuse
- Agents - Core 13.6: Intent Breaking & Goal Manipulation
- Agents - Core 13.11: Unexpected RCE and Code Attacks
- Agents - Tools MCP Server 13.18: Tool Poisoning
- Agents - Tools MCP Server 13.21: Supply Chain Attacks