Auditing Agent Skills: A Threat Model for the Next Generation of AI Package Managers

This piece maps a concrete threat model onto the emerging pattern of agent skill or tool registries, asking what happens when an agent can install new capabilities from a public registry the way a developer installs npm packages. The USB drive analogy in the opener is a bit on the nose, but the underlying point is solid: the supply chain attack surface for agent runtimes has not received the same scrutiny that package managers got after high-profile incidents in the npm and PyPI ecosystems. The article covers prompt injection via skill metadata, capability escalation, and trust boundary confusion between the agent runtime and the installed skill. For someone building an agent that accepts third-party tool integrations, this is a useful checklist even if it does not go deep on mitigations. Reservation: the threat model is more taxonomy than defense playbook — you will need to do your own mitigation work. -> Best for: AI engineer building agent frameworks or tool-use pipelines that accept third-party integrations