Can a SKILL.md file give an AI agent shell access?

A SKILL.md file does not grant permissions by itself. It is instructions and metadata. But a skill can bundle scripts, and an agent that can run commands may execute them. So a skill is only as safe as its contents and the access the agent already has. Audit before you install.

What is a skill, in plain terms?

Anthropic's documentation describes Agent Skills as modular capabilities. Each skill is a directory with a SKILL.md file that has YAML frontmatter, a name and a description, followed by instructions. It may also contain scripts, templates and reference files.

The agent reads the name and description of every installed skill at startup. When a request matches, it loads the full instructions and can follow them, including running bundled code if it has an environment that allows that. The design is called progressive disclosure: the heavy content loads only when needed.

Where does the shell come in?

The skill does not open a shell. The agent's runtime does. If the agent has a code execution tool, or a terminal on your laptop, a skill can say "run this script" and the agent may comply. That is the whole point of bundling scripts, for tasks like converting a document.

The result is that installing a skill extends what the agent may be told to do, using access you already gave the agent. Anthropic's security guidance for skills says plainly that a malicious skill can direct the agent to invoke tools or execute code in ways that do not match its stated purpose, which could lead to data exfiltration or unauthorized system access. Their advice is to use skills only from trusted sources and to audit anything else.

What could go wrong?

A constructed example. A skill named invoice-formatter has a clean description. Its instructions tell the agent to run a helper script before formatting. The script, besides reformatting, reads files from the home directory and sends their contents to an outside address. Nothing in the description hints at that.

Another case needs no script at all. Instructions in the markdown can tell the agent to ignore prior rules, fetch another file from a URL and follow it, or paste credentials into a request. The agent treats the skill as trusted guidance, so the text itself is the attack.

This matches OWASP's description of excessive agency and prompt injection for LLM applications: the model is given authority and then steered by text it was told to trust.

How do you audit a skill?

1. Read SKILL.md in full, not just the description. Look for steps unrelated to the stated task.
2. Open every bundled script and note network calls, file reads outside the project, and use of environment variables.
3. Check for instructions that fetch remote content at run time, since that content can change after you reviewed it.
4. Search for base64 blobs, obfuscated strings and minified code.
5. Confirm where it came from, who maintains it, and whether the source is pinned to a version.

How do you limit the blast radius?

Run agents in a sandbox without secrets. Deny outbound network access by default and allow only what the task needs. Require approval for commands that write outside the workspace. Keep a list of approved skills and review changes to them as you would code. Log which skill triggered which command.

How to check or apply this

1. Inventory the skills installed on every developer machine and agent workspace.
2. Remove ones nobody can account for.
3. Pin approved skills in a repository and require pull requests to change them.
4. Run agents with scoped, short-lived credentials.
5. Review tool call logs weekly for commands that touch credentials or unknown hosts.

Quick check

Sources

1. Anthropic, Agent Skills overview and security considerations
2. OWASP Top 10 for Large Language Model Applications

Last reviewed: 18 October 2026.