The AI Agent Supply Chain Has a Security Problem: Introducing Skills Scanning in FortiCNAPP Code Security

Introduction

AI agents are no longer just writing code — they're installing capabilities. Agent Skills (reusable packages that extend tools like Claude Code, Cursor, and other AI coding assistants) are the new dependency layer, and they come with the same supply chain risks that plagued npm and PyPI a decade ago — except with direct access to credentials, file systems, and shell execution.

The https://owasp.org/www-project-agentic-skills-top-10/ project now catalogues the threat landscape formally — from deliberately malicious skills (AST01) and supply chain compromise (AST02) through over-privileged access (AST03) and unsafe deserialization (AST05). The barrier to publishing a skill is a single markdown file and a week-old GitHub account. No code signing. No review process. No sandboxing by default.

Today we're releasing Skills Scanning as part of FortiCNAPP Code Security — deterministic detection of malicious and risky patterns in AI agent skill definitions, available in both our SAST scanning pipeline and the Claude Code plugin.

The Problem: Skills Are the New Supply Chain Attack Surface

A skill is typically a markdown file containing natural-language instructions that tell an AI agent what to do. Unlike traditional code dependencies, skills operate through prompt injection — they don't need to exploit a CVE or trigger a buffer overflow. They simply tell the agent to:

• Download and execute a password-protected archive from an external server
• Base64-encode credentials and exfiltrate them via curl
• Disable security mechanisms and inject persistent backdoors
• Override tool definitions to intercept sensitive operations

The OWASP Agentic Skills Top 10 identifies this dual-technique pattern as characteristic of AST01 (Malicious Skills): prompt injections manipulate the agent's reasoning to bypass safety checks, making the code execution payload more likely to succeed.

Traditional SAST tools don't scan markdown. Traditional SCA tools don't model skill dependencies. This is a gap — and attackers are already exploiting it.

What Skills Scanning Detects

FortiCNAPP Skills Scanning applies purpose-built rules across six threat categories:

• Credential Harvesting & Exfiltration — Skills that instruct agents to read credential files, harvest environment variables, or transmit sensitive data to external endpoints
• Shell Execution & Code Injection — Pipe-to-shell patterns, dynamic code loading, unsafe deserialization, and overly permissive bash execution
• Obfuscation Techniques — Base64-encoded command sequences, Unicode homoglyph attacks, and parameter obfuscation designed to evade detection
• Persistence & Permission Escalation — Skills that write to startup files, hook into agent settings, or escalate their own permissions
• Supply Chain & Dependency Risks — Unpinned dependencies, external downloads from untrusted sources, and tool override patterns
• Network & File System Abuse — Broad filesystem access, unencrypted communication, and suspicious outbound connections

For the full list of weakness IDs, detection patterns, and remediation guidance, see our Markdown Language Support documentation.

How It Works

Scanning Markdown as Code

Skills are defined in markdown — SKILL.md, .claude/skills/**/*.md, AGENTS.md, and similar conventions. FortiCNAPP treats these files as first-class scan targets using generic pattern matching. No AST required — the rules match against the natural-language instruction patterns that agents actually execute.

Precision Over Noise

Every rule explicitly excludes README files and general documentation to prevent false positives. We match against specific instruction patterns — not every mention of curl or bash in a repository. A skill that says "run curl | bash to install the tool" is flagged. A README explaining how curl works is not.

Mapped to the OWASP Agentic Skills Top 10

Our rule coverage is mapped against the OWASP Agentic Skills Top 10, the industry-standard risk taxonomy for agent skill security — covering AST01 (Malicious Skills), AST02 (Supply Chain Compromise), AST03 (Over-Privileged Skills), AST04 (Insecure Metadata), AST05 (Unsafe Deserialization), and AST07 (Update Drift).

Integration Points

Skills Scanning runs everywhere FortiCNAPP SAST runs:

Why Deterministic Detection Matters Here

It's tempting to ask an LLM to review skills for malicious intent. We deliberately chose not to. Here's why:

1. Reproducibility — The same skill produces the same finding every time. Auditors need this.
2. Evasion resistance — Prompt injection techniques that fool an LLM reviewer don't affect regex-based pattern matching.
3. Speed — 24 rules execute in milliseconds, not seconds.
4. Traceability — Every finding maps to a specific weakness ID, a specific rule, and a specific remediation. No hallucinated severity scores.

An attacker who crafts a skill specifically to evade LLM-based review (using the same prompt injection techniques the skill itself employs) gains nothing against deterministic pattern matching.

Comparison to Existing Approaches

Getting Started

Skills Scanning is enabled by default in FortiCNAPP Code Security. If you're already running SAST scans, skill files in your repositories are already being checked.

For Claude Code Plugin Users

Update to the latest plugin version. Skill findings appear alongside your existing SAST results with SKILL-* prefixed weakness IDs. No configuration change required.

For CI/CD and SCM Users

No action needed — skill rules are included in the standard SAST rule pack. Findings surface in your existing FortiCNAPP dashboard with full remediation guidance.

What This Means for Your Security Posture

If your developers use AI coding assistants, skills are already in your repositories. The question is whether you're scanning them.

The OWASP Agentic Skills Top 10 exists because this threat class is real and growing. We're closing the gap with the same deterministic, policy-based approach we apply to infrastructure-as-code, application code, and dependencies.

Every skill installed is a policy decision. FortiCNAPP makes sure it's an informed one.

Resources

• Documentation: Markdown Language Support — FortiCNAPP Administration Guide
• FortiCNAPP Code Security: forticnapp.fortinet.com
• Claude Code Plugin: github.com/lacework/forticnapp-llm-plugins
• OWASP Agentic Skills Top 10: owasp.org/www-project-agentic-skills-top-10