Skills, hooks, agent rules, MCP configurations, and instruction files like CLAUDE.md and AGENTS.md tell an AI agent what to do. Developers install them from marketplaces and public repositories with a click, and the agent follows them with full trust and almost no validation. Few people read them first.
In this Mitiga Minutes, Brian Contos, Field CISO at Mitiga, sits down with Idan Cohen, Security Researcher at Mitiga Labs and the builder of Skillgate, to look inside those files.
Brian and Idan walk through:
• Where Skillgate came from: the License to Skill research and a testing skill whose "definition of done" forked a repository and pushed the whole codebase, secrets included, to the attacker
• Why the surface is bigger than skills: hooks, agent rules, MCP server configurations, and settings files
• What the scanner is catching in public repositories, from hardcoded tokens to a coding-assistant rule that posts environment variables to an attacker's webhook and tells the agent not to mention it
• How Skillgate works in three layers: static rules tied to known CVEs and published research, heuristics for patterns with known impact, and Gator, the LLM judge that follows a hook into the script it runs
• Who is already using it, and what is next: an API, private sandboxed scans, and GitHub and Hugging Face links
Skillgate reads a file with signature and AST analysis plus an LLM-as-judge pass, maps each finding to a known attack technique, and returns a risk score out of 100 with a verdict, an explanation, and fixes. Findings map to the OWASP Agentic AI Top 10 and to MITRE ATT&CK and ATLAS. No code is executed during the scan. Browsing public scans is anonymous. Submitting your own takes a free account.
Agents made instruction files powerful, and the ecosystem made them easy to share. Nobody at Mitiga Labs wants people to stop using skills. The fix is to look before you load one.
Scan a skill at skillgate.mitiga.ai, and read the Mitiga Labs whitepaper, The Hidden Attack Surface in AI Agent Instructions.
