Agent Skills Security: How to Find, Scan and Control the Skills on Employee Computers

See it in Contro1

Turning on the daily skills report on a computer, allowing only skills from Contro1, and what an administrator sees when someone installs a dangerous skill anyway. The real Contro1 Skills page, with demo data.

The short answer

Agent skills are folders with a SKILL.md file that Claude Code, Codex, Cursor and Gemini CLI load from each employee’s computer. They change what the agent does, they can include scripts, and they arrive from marketplaces, repositories and copy-paste without review. Treat them like software installed on a laptop.

A complete control has four parts: an inventory of every skill on every computer, a security scan of each one, one approved source for the skills people need, and a policy that blocks or flags everything else. Contro1 provides all four, and the access gateway still decides what any agent may actually do.

Why agent skills are a security problem

A skill is instructions plus optional code, loaded into a trusted session. A malicious or careless one can tell an agent to download and run a script, send data out, or hide what it is doing from the person using it. Researchers have found exactly that in public skills: a large empirical study of skills in the wild catalogued malicious ones with data exfiltration and remote code patterns, and Datadog Security Labs showed that a cloned repository can bring skills into a Claude Code session without anyone installing them on purpose.

The problem is ownership. Skills live in personal folders on laptops, outside any central registry. The Cloud Security Alliance puts it simply: without an inventory, every other control is blind. This is the same shadow AI problem organizations already know from unsanctioned AI tools, one level deeper.

Datadog Security Labs: Malicious coding agent skills and dynamic context · Malicious Agent Skills in the Wild: a large-scale empirical study (arXiv) · Cloud Security Alliance: 5 Claude agent skills risks every CISO should know

Where skills hide on a computer

Each agent loads skills from its own folders. These are the places an inventory has to cover. The contro1 CLI also reads Windsurf, Goose, Kiro, Roo Code, Continue, Qwen Code, Factory Droid and other agents with a documented skills folder.

Claude Code docs: Skills (where skills load from) · OpenAI: Codex admin setup and managed configuration · OpenClaw docs: Skills (load locations and precedence) · Hermes Agent docs: Skills System · NanoClaw docs: Skills system

How to find, scan and control agent skills, step by step

Every step below is in the Contro1 Skills page. Each person does steps 1 to 3 once on their computer; an administrator does the rest.

{
  "strictPluginOnlyCustomization": ["skills"],
  "strictKnownMarketplaces": []
}

Claude Code docs: Deploy managed settings · Claude Code docs: strictPluginOnlyCustomization and other settings

What happens when someone installs a skill anyway

Contro1 does not delete files on anyone’s computer. If the skill is useful, an administrator adopts it into the library, edits it, and pushes it back through Contro1, where it is versioned and approved like every other skill.

1. Step 1

   Installed

   A person adds a skill to Codex or Cursor, or to a Claude Code without the lock.

2. Step 2

   Reported

   The daily report from that computer includes it.

3. Step 3

   Scanned

   NVIDIA SkillSpector, Cisco Skill Scanner and Contro1 check it.

4. Step 4

   Flagged

   Marked outside policy, with the person, computer and tool.

5. Step 5

   Told

   Administrators and the department manager are emailed; the person is asked to remove it.

What can be blocked, and what can only be detected

Be precise about this with your security team. Claude Code supports an organization-wide lock: with strictPluginOnlyCustomization covering skills in managed settings, it stops loading skills from personal and project folders, and managed settings sit above every user and project setting. Codex, Cursor and Gemini CLI have no equivalent documented setting today, so for them the control is detection: the daily report finds what is installed, the same day.

Two things hold in every case. Skills delivered by Contro1 reach agents over MCP, so the Claude Code lock does not stop them. And a skill is guidance, not permission: whatever a local skill tells an agent to do, the action still has to pass the Contro1 gateway, which checks the agent’s access before anything runs.

Scanning helps, and it is not enough on its own

Open-source scanners such as NVIDIA SkillSpector and Cisco Skill Scanner catch known patterns: remote scripts piped to a shell, hidden instructions, exfiltration, prompt injection. Contro1 runs both on every version, every import and every skill found on a computer, and a skill they judge dangerous needs an administrator, who approves it by name in the audit log.

Scanners can also be bypassed. OWASP’s Agentic Skills Top 10 lists poor scanning as a risk of its own, and the Cloud Security Alliance reported that no single scanner caught every bypass technique. Use the scan as one layer: combine it with one approved source, the policy, and action-level permissions at the gateway.

OWASP Agentic Skills Top 10: AST08 Poor Scanning · Cloud Security Alliance: AI agent skill scanners bypassed across the board

A checklist for security teams

Frequently asked questions

What is an agent skill?

A folder with a SKILL.md file, and optional scripts and references, that a coding agent such as Claude Code, Codex or Cursor loads to learn how to do a task. Skills change what the agent does, so they need the same review as installed software.

Are agent skills a security risk?

Yes. A skill can tell an agent to run downloaded code, send data out or hide its actions, and researchers have found malicious skills in public marketplaces. Skills on employee laptops are usually unreviewed and invisible to the organization.

How do I find which skills my employees installed?

Install the contro1 CLI once on each computer, sign in, and run contro1 skills schedule. Every day it reports the skills in Claude Code, Codex, Cursor and Gemini CLI, and Contro1 shows them by person, department and tool.

Do I need to install something for each coding agent?

No. One install of the contro1 CLI per computer covers every coding agent on it.

How are skills scanned for malicious instructions?

Contro1 scans every reported skill with NVIDIA SkillSpector, Cisco Skill Scanner and its own checks. A skill judged dangerous needs an administrator’s named approval before it can reach agents through Contro1.

Can I block employees from installing Claude Code skills?

Yes. Deploy the managed setting strictPluginOnlyCustomization with skills, through MDM, Group Policy or the managed settings file. Claude Code then loads skills only from plugins and managed sources, and users cannot override it. Skills from Contro1 still arrive over MCP.

Can I block skills in Codex or Cursor?

There is no documented setting for that today. Contro1 detects skills installed in Codex and Cursor in the daily report, scans them, and tells administrators when one appears outside policy.

Does Contro1 delete skills from employee computers?

No. It reports, scans and flags them, and tells the person and their managers. Removing a skill, or adopting it into the approved library, is a decision people make.

See, scan and control the skills on every computer.

Start free with Contro1: install the CLI on one computer, turn on the daily report, and see its skills and their scan results in minutes. No credit card required.

Related resources