The Untrusted-Skill Gate

The Untrusted-Skill Gate: a pre-install checklist for agent skills and MCP servers
An Ena Pragma method. Run it EVERY time, before a skill or MCP server touches your agent.

WHY THIS EXISTS
A skill or MCP server is instructions plus code your agent runs with your
permissions, not a document. Snyk's February 2026 audit of 3,984 marketplace
skills found 36.82% carry a security flaw and 13.4% a critical one. The
document-driven attack (arXiv:2604.03081) hides payloads in a skill's own code
examples and bypasses defenses that stop explicit injections 100% of the time.
So gate the install like you would a dependency bump, not a README.

HOW TO USE IT
Paste it into your PR template or install runbook. The reviewer is a human, not
the agent that wants the tool. Fail-closed: any FAIL means do not install. Keep
the completed rows as the audit record.

1. PROVENANCE AND AUTHOR
   Can you name the author, the repo, and the exact commit or version?
   PASS: named, reputable, pinned source. FAIL: anonymous, mirrored, or "latest".
   Why: skills and MCP servers are a supply-chain surface. Install only from
   trusted sources (Anthropic's own guidance).

2. PERMISSION SCOPE
   List everything it can touch: filesystem, network egress, shell, credentials,
   other tools.
   PASS: enumerated and least-privilege. FAIL: broad, unbounded, or undisclosed.
   Why: a skill can bundle code the agent executes as tools.

3. PROMPT-INJECTION SCAN OF ITS OWN DOCS
   Grep the description, docstrings, README, and tool metadata for hidden
   instructions: IMPORTANT tags, "ignore previous", invisible or off-color text,
   and payloads planted in code examples.
   PASS: clean. FAIL: any directive aimed at the model.
   Why: tool poisoning hides instructions in descriptions that are invisible to
   users but read by the model.

4. LEAK AND EXFILTRATION SCAN
   Does any bundled script send data to an external endpoint, read secrets or
   env, or write outside its lane?
   PASS: no undisclosed egress. FAIL: hardcoded URLs, key reads, off-lane writes.

5. LETHAL-TRIFECTA CHECK
   Does adding this put private-data access, untrusted-content exposure, and
   external communication in the same agent at once?
   PASS: at least one leg removed or gated. FAIL: all three co-present.
   Why: that combination is what lets an attacker exfiltrate (Simon Willison's
   "lethal trifecta").

6. PIN AND INTEGRITY
   Pin the exact version and record a hash or checksum of the tool definition.
   Block silent updates.
   PASS: pinned and hashed. FAIL: auto-update or unpinned.
   Why: a rug-pull changes the tool description after you approved it.

7. SANDBOX AND DRY-RUN
   Exercise it once in an isolated, no-secrets, no-prod environment and watch
   its actual calls.
   PASS: behavior matches the description. FAIL: surprise calls or scope creep.

8. HUMAN-APPROVAL GATE
   A named human who is NOT the requesting agent signs off after reading the
   bundled files, especially code dependencies and any pointer to untrusted
   external sources.
   PASS: recorded sign-off. FAIL: agent self-approved.
   Why: thoroughly audit a less-trusted skill before use (Anthropic). OWASP's
   MCP guidance calls for required review and multi-person approval before a
   tool or schema change is accepted.

9. RE-SCAN TRIGGER
   Write down what forces a re-run of this gate: a version bump, a hash change,
   a new permission, a new egress.
   PASS: trigger written down. FAIL: install-once-and-forget.

10. AUDIT-LOG ENTRY
    One immutable line: tool, version, hash, scope, reviewer, date, decision.
    PASS: logged. FAIL: no record. This completed row-set IS the entry.

THE RULE IN ONE LINE
Read it before you run it. A skill that reads like documentation is still a
program you are about to execute with your own permissions.