AST05: Untrusted External Instructions
Risk Level: High
Skills routinely point the agent at external documentation: an API reference, a schema, a runbook, a URL to read at runtime. That content becomes part of the skill's instructions. The agent loads it, trusts it exactly as it trusts the skill, and acts on it with the host agent's full permissions.
The skill package itself may be signed and version-pinned. What it points at is not. That content is mutable, unverified, and sits outside the trust boundary, so an audited skill can become a malicious one without the package changing at all.
Three ways it gets exploited
- Author rug-pull — ship a benign skill pointing at documentation you control, pass review, then change the referenced content. Every running agent picks it up.
- Reviewer bait-and-switch — serve clean documentation to reviewers and scanners by IP or user-agent, and malicious instructions to live agents.
- Transitive reference chaining — the referenced document points at further resources. Control a link deep in the chain and review that only checks direct references never sees it.
How common is it
Air Security's The Circus of Skills (June 24, 2026) scanned 142,836 live skills and found 17,822 of them (about 12.4%, totaling 6.7 million installs) referencing at least one unvetted external instruction source: zero-reputation GitHub repos, free-tier hosts, and unknown domains with nothing preventing a later takeover. Their earlier proof of concept, The Story of Skills (June 22, 2026), demonstrated full agent compromise through exactly this path.
Anthropic's own Agent Skills guidance makes the same point: skills that fetch data from external URLs pose particular risk, because fetched content may carry malicious instructions, and even a trustworthy skill can be compromised if its external dependencies change.
Mitigations
- Pin a cryptographic hash for every external document at review time and re-verify on each load, refusing drifted or unpinned content
- Snapshot external documentation into the signed skill package at publish time so it is reviewable and immutable
- Allowlist the domains and URL patterns a skill may fetch from, and prefer stable ones unlikely to lapse
- Audit reference chains transitively — a document's own outbound references are part of the skill's attack surface
- Keep a fleet-wide inventory of which deployed skills fetch from which sources, so a compromised source can be traced and revoked fast
- Rescan external sources continuously; a scan is a snapshot of mutable state, not a durable clearance