Truth in IT
    • Sign In
    • Register
        • Videos
        • Channels
        • Pages
        • Galleries
        • News
        • Events
        • All
Truth in IT Truth in IT
  • Data Management ▼
    • Converged Infrastructure
    • DevOps
    • Networking
    • Storage
    • Virtualization
  • Cybersecurity ▼
    • Application Security
    • Backup & Recovery
    • Data Security
    • Identity & Access Management (IAM)
    • Zero Trust
    • Compliance & GRC
    • Endpoint Security
  • Cloud ▼
    • Hybrid Cloud
    • Private Cloud
    • Public Cloud
  • Webinar Library
  • TiPs
  • DRAW

AI Agent Skills Security Risks: What Snyk Found

Snyk
06/16/2026
0 (0%)
Share
  • Comments
  • Download
  • Transcript
Report Like Favorite
  • Share/Embed
  • Email
Link
Embed

Transcript


That's how fast developers are downloading agent skills right now. Packages that don't just run code, but give an AI agent the ability to execute commands on your behalf. It can access your file system, read your environment variables, maybe even touch your production infrastructure. And Snyk just finished scanning nearly 4,000 of them. What we found should change how you think about installing anything into your AI agent stack. Today, I'm going to walk you through exactly what agent skills are, why they're a fundamentally different security problem than traditional packages, what the data shows about the current state of the ecosystem and most importantly, what you can do right now to protect yourself. By the end of this video, you'll know exactly how to vet any agent skill before it touches your machine using free tools that are available today.

TL;DR

  • AI agent skills are being downloaded 235,000 times per week, representing packages that execute commands and access system resources on behalf of AI agents
  • Snyk's analysis of nearly 4,000 agent skill packages reveals security risks that differ fundamentally from traditional software package vulnerabilities
  • Agent skills can access file systems, environment variables, and production infrastructure, creating new attack vectors that require specialized vetting approaches

Summary

This security briefing examines the emerging threat landscape of AI agent skills—packages that enable AI agents to execute commands and access system resources. With 235,000 weekly installs and Snyk's analysis of nearly 4,000 packages revealing significant security concerns, the video addresses why agent skills represent a fundamentally different attack surface than traditional software packages. The presentation covers the unique security challenges posed by packages that can access file systems, read environment variables, and interact with production infrastructure, while providing practical guidance on vetting these tools before deployment. Developers and security teams will learn how to assess agent skills using available free tools to mitigate risks in their AI agent implementations.

Chapters

0:00 - Agent Skills Adoption Rate
0:06 - Security Capabilities and Risks
0:18 - Snyk Research Findings
0:26 - Protection Strategies

Key Quotes

0:00 "... 235,000 installs per week. That's how fast developers are downloading agent skills right now."
0:18 "Snyk just finished scanning nearly 4,000 of them. What we found should change how you think about installing anything into your AI agent stack."
0:29 "... why they're a fundamentally different security problem than traditional packages ..."

FAQ

What makes AI agent skills different from traditional software packages from a security perspective?

Agent skills are fundamentally different because they give AI agents the ability to execute commands directly on systems, access file systems, read environment variables, and potentially interact with production infrastructure—creating execution risks beyond traditional code vulnerabilities.


Categories:
  • » Cybersecurity » Application Security
  • » Data Protection
Channels:
News:
Events:
Tags:
  • Application Security
  • AI & Machine Learning
  • DevSecOps
  • Technical Deep Dive
  • AI Agent Security
  • Software Supply Chain
  • Package Vulnerability Scanning
  • AI Agent Skills
  • Runtime Security
Show more Show less

Browse videos

  • Related
  • Featured
  • By date
  • Most viewed
  • Top rated
  •  

              Video's comments: AI Agent Skills Security Risks: What Snyk Found

              Upcoming Webinar Calendar

              • 06/17/2026
                12:00 PM
                06/17/2026
                Action1: The Remediation Gap: Vulnerability Management in the Age of AI
                https://www.truthinit.com/index.php/channel/2010/action1-the-remediation-gap-vulnerability-management-in-the-age-of-ai/
              • 06/23/2026
                01:00 PM
                06/23/2026
                The AI-Powered VMware Alternative
                https://www.truthinit.com/index.php/channel/2009/the-ai-powered-vmware-alternative/
              • 06/24/2026
                11:00 AM
                06/24/2026
                LATAM: Accelerating Insights on AI Through an Engaging Webinar Series
                https://www.truthinit.com/index.php/channel/2012/accelerating-insights-on-ai-through-an-engaging-webinar-series/
              • 06/25/2026
                01:00 PM
                06/25/2026
                Generative AI Security: Preventing AI from Becoming a Data Breach Multiplier
                https://www.truthinit.com/index.php/channel/1998/generative-ai-security-preventing-ai-from-becoming-a-data-breach-multiplier/
              • 06/30/2026
                01:00 PM
                06/30/2026
                Master Active Directory Certificate Services for Long-term Success
                https://www.truthinit.com/index.php/channel/2018/master-active-directory-certificate-services-for-long-term-success/
              • 07/01/2026
                04:00 AM
                07/01/2026
                Integrating Security in AI: Automated Red Teaming Strategies for Private Models
                https://www.truthinit.com/index.php/channel/1969/integrating-security-in-ai-automated-red-teaming-strategies-for-private-models/
              • 07/01/2026
                04:00 AM
                07/01/2026
                Schutz von KI in Anwendungen, Agenten und APIs.
                https://www.truthinit.com/index.php/channel/2008/schutz-von-ki-in-anwendungen-agenten-und-apis/
              • 07/01/2026
                01:00 PM
                07/01/2026
                Stop Your AI from Controlling You: Strategies for Retaining Power
                https://www.truthinit.com/index.php/channel/2021/stop-your-ai-from-controlling-you-strategies-for-retaining-power/
              • 07/02/2026
                10:00 AM
                07/02/2026
                When the cloud goes dark: Resilience lessons from hybrid threats
                https://www.truthinit.com/index.php/channel/2011/resilience-insights-from-hybrid-threats-when-the-cloud-faces-challenges/
              • 07/14/2026
                11:00 AM
                07/14/2026
                In-Depth Analysis of the Latest Features in Netwrix 1Secure
                https://www.truthinit.com/index.php/channel/2014/in-depth-analysis-of-the-latest-features-in-netwrix-1secure/
              • 07/21/2026
                04:00 AM
                07/21/2026
                Strategies for Managing AI Governance and Securing App-to-LLM API Traffic
                https://www.truthinit.com/index.php/channel/1967/strategies-for-managing-ai-governance-and-securing-app-to-llm-api-traffic/
              • 07/22/2026
                06:30 AM
                07/22/2026
                Insights and Strategies for Effective Data Privacy and Protection Practices
                https://www.truthinit.com/index.php/channel/2000/insights-and-strategies-for-effective-data-privacy-and-protection-practices/
              • 07/29/2026
                04:00 AM
                07/29/2026
                Real-Time Strategies for Safeguarding Against Prompt Injections
                https://www.truthinit.com/index.php/channel/1968/real-time-strategies-for-safeguarding-against-prompt-injections/
              • 09/30/2026
                04:00 AM
                09/30/2026
                EMEA: Shadow AI, MCP, and Emerging Risks of Artificial Intelligence
                https://www.truthinit.com/index.php/channel/2024/shadow-ai-mcp-and-emerging-risks-of-artificial-intelligence/

              Upcoming Events

              • Jun
                17

                Action1: The Remediation Gap: Vulnerability Management in the Age of AI

                06/17/202612:00 PM ET
                • Jun
                  23

                  The AI-Powered VMware Alternative

                  06/23/202601:00 PM ET
                  • Jun
                    24

                    LATAM: Accelerating Insights on AI Through an Engaging Webinar Series

                    06/24/202611:00 AM ET
                    • Jun
                      25

                      Generative AI Security: Preventing AI from Becoming a Data Breach Multiplier

                      06/25/202601:00 PM ET
                      • Jun
                        30

                        Master Active Directory Certificate Services for Long-term Success

                        06/30/202601:00 PM ET
                        More events
                        Truth in IT
                        • Sponsor
                        • About Us
                        • Terms of Service
                        • Privacy Policy
                        • Contact Us
                        • Preference Management
                        Desktop version
                        Standard version