DEV Community
•
2026-08-09 22:51
From Threat Model to Framework: Closing the Real Gaps in Agent Skill Security
A couple of weeks ago I wrote about the risk hiding inside AI Agent Skills, the small instruction folders that Claude, GitHub Copilot, and other agents now install like packages, and the fake malicious skill I built to prove that risk was real (full piece here if you want the background). That post was the problem statement, a threat model, and a proof of concept.
This post is the framework. Sinc...