You Can't Tell What an Agent Skill Will Do by Reading It - Roey Ben Chaim, Zenity

Why watch

Roey Ben Chaim explains why reading SKILL.md files cannot establish what an AI agent will actually do - instructions can fetch more instructions, install scripts can pull packages that create hidden processes. He demonstrates an agent detonation chamber approach: sandbox, world builder, operator for path exploration, and instrumentation for runtime evidence collection. Concrete cases show chained skill installation, misleading package names, persistence mechanisms, and credential harvesting through lookalike projects. The takeaway is treating skills as software dependencies with runtime monitoring essential for security.