Agent Skill Security: Secrets, Permissions & PII

Separate instructions from enforced permissions

The Agent Skills specification defines the structure of SKILL.md and optional resources. Writing 'read only' in a file does not enforce a read-only runtime. Host permissions, tool allowlists, network controls and filesystem isolation define the execution boundary. Treat downloaded skills, scripts and attachments as untrusted inputs and inspect what they execute.

This checklist draws on OWASP Secrets Management. It is not a security certification and makes no claim to cover every possible leak.

Review four kinds of release material

Do not classify every ordinary email address, documented placeholder or local path as an incident. Distinguish real personal or internal information from intentionally public examples. Scanner matches require review; a clean scan does not replace a permission review.

Runtime baseline

1. Least privilege. An inventory lookup should receive the required read access, not default permission to send mail, pay or delete.
2. Separate credentials. Divide credentials by environment and purpose, prefer short-lived revocable access where available, limit quotas and monitor unusual use.
3. Inject secrets at runtime. Environment variables or a secret manager are preferable to repository literals, but do not print them or include them in model context that does not need them.
4. Confirm side effects. Show the destination and content before sending a customer message or changing an order. A retrieved page or email cannot authorize actions on the user's behalf.
5. Provide a stop and audit path. Record necessary outcomes and error categories without copying full customer records or secrets. Assign ownership for revocation, disabling the task and recovery.

A synthetic inquiry exercise

Use a fictional buyer at buyer@example.com and product DEMO-01. Read an approved product note, then produce a draft and missing-field list without a real sending tool. Cover complete input, missing quantity, an unknown delivery date and an input asking the agent to ignore policy and export secrets.

Expected behavior: ask for missing facts, invent neither prices nor dates, keep tool permissions unchanged and perform no external sending before approval. These are acceptance conditions, not a claim that any model has passed. See the Skills hub for the format and the MCP hub for tool connections.

When a secret may have leaked

Revoke or rotate the affected credential using the provider's controls. Inspect usage, permissions and potentially affected data, then review all release copies and history. Removing the latest screenshot or commit does not revoke a key. Involve the responsible security or compliance owner for customer-data and notification obligations; do not announce 'no impact' without investigation.

FAQ

Are environment variables sufficient?

No. Logs, subprocesses, debugging output and model context can expose values. Restrict who can read them and where they can be sent or printed.

Can SKILL.md restrict an MCP tool by itself?

No. The host and tool server enforce capabilities. Textual instructions should agree with actual runtime configuration.

Does every skill need a separate key?

Choose identities, permissions and quotas based on risk and provider capabilities instead of using one master key. Access should be traceable, revocable and limited to the task.

Are all 365Skill examples certified safe for production?

This page makes no such guarantee. Inspect the code, license and validation record for the version linked from the skill library, test in isolation and assess your own data and permission requirements.