Risk · R-062 · Agentic & Autonomous Systems
Over-privileged agent skills and tools
Reusable skills and tool definitions request broader permissions than their function needs and run without isolation, enlarging the effect of any misuse.
- Severity
- Medium
- Audience
- Practitioner
- Frameworks
- AML.M0028 · AST03 · AST06
- Responsible AI domain
- Lifecycle stage
- Reviewed
- 2026-11-10
What it is
A skill is a packaged capability that an agent can load: instructions, code and a declaration of what it needs to access. This entry concerns the package. A skill that asks for the whole file system to read one folder, or network access it never uses, carries that excess into every agent that loads it. Excessive agency is the same condition at the level of the agent.
How it happens
- Skill authors request broad permissions for convenience.
- Permission declarations are not checked against what the skill does.
- Skills run in the agent's own process, with no boundary between them.
- A skill written for one platform is reused on another with a wider default grant.
Why it matters
When a skill is compromised or misused, its permissions define the damage. Over-privileged skills also defeat least-privilege design for the agent, since the agent's effective access is the sum of what its skills hold.
Warning signs
- Skills declare wildcard or administrative permissions.
- Nobody has compared declared permissions with observed use.
- Skills can read each other's data.
- Installing a skill requires no review.
Mitigating controls
Primary controls
- Agent tool and skill vetting Preventive
- Reviews the permissions each skill requests before approval. Tools, skills and connectors are reviewed, scanned and approved before an agent may load them, are loaded only from approved sources, and are re-reviewed when they change.
- Least-privilege agent identity and permissions Preventive
- Grants a skill only the access its function needs. Each agent has its own identity, with permissions scoped to its task and to the user it is acting for, short-lived and reviewed like any other entitlement.
Supporting controls
- Agent sandboxing and isolation Preventive
- Isolates skills from each other and from the host. Code execution and tool use by agents run in isolated environments with restricted network, file and system access, so that a failure is contained where it occurs.
Framework and clause references
| Framework | Clause | Title |
|---|---|---|
| MITRE ATLAS | AML.M0028 | Enforce Access Controls for AI Agent Tools Tool permission configuration. |
| OWASP Agentic Skills Top 10 | AST03 | Over-Privileged Skills The entry this risk is named for. |
| OWASP Agentic Skills Top 10 | AST06 | Weak Isolation Weak isolation. |
Sources
- MITRE ATLAS MITRE · framework
Related terms
How to cite
Axiom Verity (2026). Over-privileged agent skills and tools. Reference Library, R-062. https://axiom-verity.com/risks/over-privileged-agent-skills. Reviewed 2026-11-10.
Found an error or a better source? Report a correction.