Dangerous AI Skills

How attackers hijack your coding agent

Johannes Hoppe · agentic.schule

The talk

SlidesOpen in the browser. Arrow keys or space to navigate.View Slides as PDFFor reading offline or sharing with your team.Download
The full case studyThe article behind the talk, with every source. Also in German.
Five-minute checkOne page to print or to put into your team wiki. Also as PDF.

Take this home

1. Prompt: adopt a skill without copying it

Let your agent read the skill as untrusted text, list every link and command in it, and then write a new skill for your project in its own words. Then read the result yourself.

View the rewrite prompt

2. Settings: sandbox on, no unattended network access

Antigravity. In the App, keep the Default permission preset (sandbox on). The CLI starts without the sandbox: use agy --sandbox or "enableTerminalSandbox": true. Stay away from Turbo (App) and --dangerously-skip-permissions (CLI) with a new skill. Plugins install from any GitHub URL with agy plugin install; read them before you do. A deny rule for curl does not stop downloads: any tool that reaches the internet can fetch code. What helps is the sandbox and a prompt before every network access.

Gemini CLI (since 18 June 2026 for Gemini Code Assist Standard/Enterprise). The sandbox is off by default. Start with gemini --sandbox, or set it in settings.json:

{
  "tools": { "sandbox": true }
}

Avoid --approval-mode=yolo and the --consent flag of gemini skills install, which skips the security prompt. On macOS the default sandbox profile still allows outbound network.

Claude Code. Since v2.1.283 it starts in auto mode, where a classifier decides instead of a prompt and read-only HTTP requests are allowed. For a new skill, use manual mode and the sandbox. In ~/.claude/settings.json:

{
  "sandbox": { "enabled": true },
  "permissions": {
    "defaultMode": "default",
    "deny": ["Bash(curl *)", "Bash(wget *)"]
  }
}

Also check a skill’s frontmatter for allowed-tools: in Claude Code a skill can pre-approve its own tools. A deny rule does not catch the same program called by path or inside sh -c.

Codex. Sandbox on and network off by default. Keep it that way in ~/.codex/config.toml and never use --yolo with a new skill:

sandbox_mode = "workspace-write"
approval_policy = "on-request"

Check the docs of your tool for the current syntax. Links below.

3. The five-minute check

  1. Read the SKILL.md, the file the agent reads, not the README of the marketplace.
  2. Search for addresses. Does every domain really belong to the vendor? Is the spelling exactly right?
  3. Look into the scripts and everything the skill wants to install.
  4. Origin over popularity. Who submitted it?

A skill that fetches instructions from the internet cannot be reviewed. Treat untrusted skills as inspiration.

All sources

The case: brand-landingpage from wshobson/agents

Where brand-landingpage was listed (4 November 2026)

The listings shown on the slides. Warning: do not install.

Research

Backup: popular skills, analyzed

Reached real users and still work today, as of 5 November 2026. Links to code point to the exact commit. Warning: do not install.

Vendor documentation

Want to go further?

Workshops at agentic.schuleWorking safely and productively with AI coding agents, for teams. In German and English.agentic.schule Questions and feedbackTell me how your team handles skills. I read every message.LinkedIn