Agent skills inherit all permissions of the agent itself rather than operating in a constrained environment, and they can be triggered through natural language manipulation rather than explicit code calls, creating a much larger and harder-to-detect attack surface.
