Security tooling should treat prompt and agent skill files as code: stored in version control, reviewed in pull requests, owned by a named person and recorded in your inventory. They steer what an agent does, so an unreviewed change is an unreviewed change to behavior. Ask whether your tools can even see them.
Why they matter
A prompt or skill file is text that tells an agent how to act, which tools to prefer and what to avoid. A small edit can widen what an agent attempts. OWASP's LLM Top 10 lists system prompt leakage and excessive agency as separate risks, and both connect to these files: what is written in them, and how much power they grant.
They also carry secrets by accident. A pasted key, an internal URL or a customer name in a prompt travels wherever the file goes. This post gives no claim that any product scans for those, so check your own tooling.
What good handling looks like
- Version control. Every prompt and skill file lives in a repository, not in a chat window or a wiki.
- Review. Changes go through pull requests, with a reviewer who checks scope of tools and data.
- Ownership. One named owner per file or set of files.
- Separation. Secrets stay out. Use references to a secret store.
- Inventory. Files are listed with their owner, the agent that uses them and the tools they enable.
- Change trigger. An edit that adds a tool or widens access triggers an extra review.
A quick table to assess your tooling
| Question | If yes | If no |
|---|---|---|
| Does the tool list prompt and skill files as assets? | Good, check fields | Inventory by search and process |
| Can a gate fire when one changes? | Add a rule for tool changes | Use code owners as a substitute |
| Can it show which agent uses which file? | Useful for impact | Record it by hand |
Code owners files are a practical stand in. Mark prompt directories so that a named group must approve changes.
Third party skills
Skills and plugins from outside are packages in all but name. Treat them the way you treat dependencies: approve before use, pin versions, and review updates. See AI agent skills and plugin repositories need the same governance as packages.
What not to expect
No tool can read a prompt and tell you whether it is safe in every case. Review remains a human judgement. Tooling can make sure review happens, shows what changed and keeps the record.
Try it yourself
The pull request gate demo shows a rule firing on a change. Imagine the same rule firing when a prompt file adds a new tool.
Click through it at your own pace, or open it full screen.
Safeguard offers policies, gates and guardrails and asset discovery. Confirm how any product handles prompt files with a test change in your own repository. The free scan is at gold.safeguard.sh/scan.
Quick check
Should prompts be reviewed like code?
Yes. A prompt change can alter behavior as much as a code change, and review leaves a record.
Where should secrets go instead?
In a secret manager, referenced by name at runtime. Never paste keys into prompts or skill files.
Sources
Last reviewed: 19 October 2026.
