Agent Skill Supply-Chain Security: Patching Injection | The Agentic Stack

Agent skill supply-chain security is where prompt injection is heading next. This week on The Agentic Stack, we work through SkillSecurer, an arXiv preprint submitted on September 12, 2026, that detects and patches prompt injection vulnerabilities inside the reusable capability modules agents load. The conversation covers why a skill's instruction text and tool declarations are trusted by default, and why runtime input filtering never sees them. They also walk through the Open Worldwide Application Security Project's 2026 injection entry, which expands the definition of injection to cover tool output, intermediate reasoning traces, and persistent memory, plus the documented skill-dispatch pattern that pushes reusable skills into small embeddable kernels. Builders get a concrete control: treat skills as untrusted dependencies, pin and diff them, and put a detection gate in continuous integration and in the load path. The episode is candid about limits. SkillSecurer is a preprint with no independent production validation, and load-time scanning does not replace runtime handling of tool output. Closing with signed skill manifests and memory-write detection as the two things worth watching. The Agentic Stack.

Keywords: agent skill supply-chain security, prompt injection, OWASP LLM01 2026, SkillSecurer, AI agent security, tool output injection, persistent memory injection, skill detection and patching, agent frameworks, secure agent skills, indirect prompt injection, agent governance

Disclaimer: The views and opinions expressed on The Agentic Stack are solely those of the author and do not represent or reflect the opinions, views, or positions of any individual, company, or organization with which the author is affiliated. This podcast is provided for informational purposes only. Portions of this podcast were produced with the assistance of artificial intelligence.