A CISO’s Guide to Agent Skills and MCP Governance

The Ungoverned AI Supply Chain: Why Skills and MCP Are Your Newest Attack Surface

Your software supply chain just grew a second head. While your team audits npm packages and container images, developers are quietly installing thousands of AI agent skills and MCP servers — most of them never touched by a security review. The scale is hard to overstate: MCP now sees 97M+ monthly SDK downloads across 10,000+ active public servers, while the skills ecosystem has swelled to over 70,000 skills on ClawHub. Meanwhile, 70% of enterprises already run AI agents in production.

Here's the number that should anchor your board briefing: Unit 42's behavioral-integrity scan of 49,943 skills found that 80% had at least one declaration/behavior mismatch — the skill says one thing, does another — and 5% carried multi-stage attack chains like FILE_READ → base64 → NETWORK_SEND exfiltration sequences. Two patterns, silent credential exfiltration and instruction-override hijacking, cover 88% of those chains.

The deployment picture makes governance worse, not better. Clutch Security found that 86% of MCP servers run locally on developer machines — workstations holding source code, cloud credentials, and CI/CD tokens — with only 5% in production where traditional security oversight applies. Credential hygiene compounds the problem: of 5,200+ servers analyzed by Astrix, 53% rely on static API keys and only 8.5% use OAuth.

And the governance gap behind it all:

• Only ~23% of organizations have a formal AI-agent identity strategy
• Only 14.4% of agents reach production with full security approval
• Only 24% have a dedicated AI security governance team
• Only 29% feel prepared to secure agentic AI at all (Cisco 2026)

Unit 42 frames the ecosystem as where mobile apps and browser extensions were a decade ago: extensibility has outpaced the supply-chain audit primitives that should gate it. The nuance matters for how you brief leadership — 81.1% of detected skill deviations are developer oversight, not malice — but oversight at this volume is still risk, especially since no registry publishes a "% security audited" figure and CoSAI scored audited MCP servers an average of just 34/100.

The threat lives in the chain, not the link. Individually "safe" MCP servers became an RCE vector when chained together, and vendor-official reference implementations have shipped exploitable CVEs. This is the verification gap SkillzBench is building against: continuously discovering and deduplicating skills, pinning every version to a commit SHA, security-scanning and benchmarking each one in a sandbox, and publishing a 0–100 trust score so teams can verify before installation rather than audit after the incident.

If your agents consume skills and tools nobody vetted, you don't have an AI strategy — you have an ungoverned supply chain with a friendly interface. Join the SkillzBench waitlist to get verified, benchmarked skills intelligence as it launches.

Where Existing Controls Break: Rug Pulls, Composability, and the Credential Gap

Your security team approves an MCP server. Three weeks later, the same server silently redefines its tools to include malicious instructions — and nothing in your approval workflow notices. This is the rug pull, one of several documented 2025 attack classes that expose just how poorly traditional controls map to agent infrastructure, as Microsoft's security team describes: hosted tool definitions can be dynamically amended after user approval.

The problem compounds because agents are compositional. Cyata researchers demonstrated that chaining Anthropic's own Git MCP server with the Filesystem MCP server enabled remote code execution via indirect prompt injection — each server was individually "safe," but the combination broke every security assumption. Cyata CEO Shahar Tal's warning is blunt: "If Anthropic gets it wrong — in their official MCP reference implementation for what 'good' should look like — then everyone can get [MCP security] wrong." Those reference servers later shipped three CVEs (CVSS 6.3–6.5) with a disclosure-to-patch window of roughly six months.

Unit 42's audit of 49,943 agent skills found the same pattern in the skills ecosystem: the threat lives in the chain, not the link. Exfiltration chains (FILE_READ → base64 → NETWORK_SEND) and RCE chains (download → write → execute) evade single-capability scanners entirely. Critically, their research found that just two patterns — silent credential exfiltration and instruction-override hijacking — cover 88% of multi-stage attack chains, giving defenders a focused detection target.

The credential layer beneath all of this is systemically broken. Astrix's analysis of 5,200+ MCP servers found that 88% require credentials, 53% rely on static API keys or personal access tokens, only 8.5% use OAuth, and 79% pass keys via environment variables. GitGuardian separately counted 24,008 secrets sitting in MCP-related config files on public GitHub, with 2,117 still valid.

• Rug pulls: tool definitions silently redefined after approval, defeating point-in-time review.
• Composability risk: individually safe servers become dangerous when chained together.
• Credential stagnation: static keys in env variables, rarely rotated, rarely scoped.
• Slow upstream remediation: even vendor-official code took months to patch.

This is why point-in-time approval fails as a governance model. A skill or server you vetted on Monday is not the artifact your agent runs on Friday — upstream changes, silent redefinitions, and newly disclosed CVEs all invalidate your review. Astrix notes a further limitation: you cannot reliably distinguish sensitive from non-sensitive tools from definitions or READMEs alone; code-level analysis is required.

It's exactly this gap that SkillzBench is building against — pinning every skill version to a commit SHA, re-scanning on upstream change, and gating what each agent can actually see through per-agent loadouts. Until such controls exist in your environment, treat every installed skill and MCP server as an unreviewed dependency that can change underneath you, because the data says it can.

The Governance Blueprint: Verify Before Install, Pin Every Version, Segment Every Agent

The good news is that the security community has converged on a governance model for agent skills and MCP — the bad news is that almost nobody has implemented it. Only about 23% of organizations have a formal AI-agent identity strategy, and just 14.4% of agents reach production with full security approval.

The consensus framework has three layers. First, Unit 42's audit of 49,943 skills — which found 80% carried at least one declaration/behavior mismatch and 5% contained multi-stage attack chains — recommends a behavioral-integrity check before installation, not after. Second, Microsoft reframes the supply chain itself: it now extends to foundation models, embeddings services, and context providers, so skills must be governed like any other dependency. Third, UiPath CISO Scott Roberts offers a six-pillar blueprint:

• Identity first — identity is the enforcement layer for autonomy, not just an access layer
• Tool segmentation — each agent sees only the skills and tools explicitly granted to it
• Runtime guardrails and memory protection
• Auditability, decision provenance, and human escalation pathways

Version pinning is the connective tissue. Rug pulls — silent tool redefinition after user approval — are a documented attack class, and even Anthropic's own Git MCP server took roughly six months from disclosure to patch. Any governance model that doesn't pin every skill to an immutable commit SHA and track upstream changes is theater.

The core principle unifying all three frameworks comes from Roberts: "Policies written in documentation do not constrain autonomous systems." Governance must be enforced at the point of installation and at runtime — mechanically, not aspirationally. An agent that can read a policy PDF can also ignore it.

This is the gap SkillzBench is being built to close: pinning every skill version to a commit SHA, validating and security-scanning before installation, and equipping each agent with only the tools an operator explicitly toggled on. Verification has to happen where installation happens — otherwise the 86% of MCP servers running on developer laptops stay invisible until they exfiltrate something.

What Good Looks Like: A Control Plane for Skills, Evidence Over Claims

Ask a vendor whether their MCP server or agent skill is secure, and you'll get a confident yes. Ask them to prove it, and the room goes quiet. No registry today publishes a "% security audited" figure, and when CoSAI audited 17 MCP servers, they scored an average of 34/100 on security — a failing grade for an ecosystem with 97M+ monthly SDK downloads.

For CISOs, the lesson from 2025's incident record is that trust must be built on evidence, not reputation. Even Anthropic's official Git MCP server shipped exploitable CVEs, and it took roughly six months from disclosure to patch. A governance program that relies on vendor claims is a governance program with no controls.

Evidence starts with provenance. Because rug pulls — silent redefinition of tools after user approval — are a documented attack class, every skill and server your agents consume should be pinned to an immutable version. A commit SHA, not a floating "latest" tag, is the difference between an auditable dependency and an open-ended promise that can change underneath you.

Next, verification has to be technical, not testimonial. The checks that matter include:

• Commit-SHA version pinning, so what you reviewed is what you run
• Security scanning and behavioral checks, since 80% of 49,943 scanned skills showed declaration/behavior mismatches
• License validation, so legal risk surfaces before deployment, not after
• Continuous upstream change tracking, so a skill that turns malicious next month gets caught — and re-scanned

Effectiveness deserves its own lane. A skill can be clean and still useless. Measured Lift — the performance delta a skill produces in a controlled sandbox, tested with and without the skill on the same model — should always be published separately from trust ratings, so a "safe" score can never masquerade as a "works well" score. UiPath CISO Scott Roberts notes that procurement has shifted from "is AI secure?" to "how do you prove it?" — and proof applies to value as much as to risk.

Finally, govern what each agent can actually see. Per-agent loadouts enforce tool segmentation: an agent only sees the skills and tools explicitly chosen for it, which shrinks the composability attack surface that let individually safe servers chain into RCE. It's the runtime expression of least privilege for a workforce of digital actors.

This is the gap SkillzBench is being built to close. Its five pillars — Discover, Verify, Benchmark, Equip, and Stay current — form a control plane for skills: continuous crawling and deduplication from GitHub, commit-SHA verification with security and license checks, sandboxed Lift benchmarking, per-agent loadouts over a single MCP server, and upstream change tracking that re-scans and notifies when a dependency mutates. A 0–100 trust score draws on security, quality, license, maintenance, and community signals, with money never touching scores.

The takeaway for security leaders is simple: demand the same evidentiary standard for agent skills you already apply to software dependencies. If a supplier can't show you pinned versions, scan results, and measured Lift, that's not a supplier — it's an unmanaged risk.

Your 90-Day Action Plan: From Shadow Skills to Audited Loadouts

Ninety days is enough time to move from "we have no idea what our agents are running" to a governed, auditable skill and MCP estate — if you sequence the work correctly. Gartner's warning that more than half of successful AI-agent attacks through 2029 will exploit access-control issues means the first 30 days must focus on visibility, not tooling purchases.

Start with inventory. Remember that 86% of MCP servers run locally on developer machines, outside most security oversight. Sweep workstations for installed skills, MCP configs, and the credentials attached to them — GitGuardian found 24,008 secrets in public MCP config files, 2,117 still valid. Expect surprises.

Days 31–60 shift from visibility to control. Build an allowlist of approved skills and servers, then enforce per-agent tool segmentation so no single agent holds both filesystem and network reach — Unit 42 found that 5% of 49,943 scanned skills carried multi-stage attack chains, and Cyata showed individually safe servers become dangerous when chained. Pin every approved skill to a commit SHA with change notifications, since rug pulls silently redefine tools after approval.

Your governance checklist for this phase:

• Complete inventory of skills and MCP servers across all developer machines, refreshed weekly
• Approved allowlist with per-agent loadouts — each agent sees only its assigned tools
• Version pinning with automated upstream-change tracking and re-scan on every update
• Scoped, short-lived credentials replacing static API keys and environment-variable passing
• Pre-installation behavioral-integrity checks rather than post-hoc scanning

Days 61–90 change the procurement conversation. UiPath's CISO frames the shift plainly: the question is no longer "is it secure?" but "how do you prove it?" That applies to internal tooling too. When evaluating emerging options — SkillzBench is building exactly this kind of pre-installation verification, with commit-SHA pinning, security scanning, per-agent loadouts, and measured Lift benchmarking as its core pillars — map every vendor claim against the blueprint above. Ask whether ratings are separated from performance data, whether scores touch money, and whether script-bearing skills are quarantined from instruction-only ones.

Close the quarter by reporting three numbers to the board: percentage of agent estate inventoried, percentage running on allowlisted, pinned skills, and incident exposure from unpinned components. Governance does not slow innovation — it unlocks the trust that accelerates adoption. Ninety days of disciplined work turns shadow skills into an audited loadout you can actually defend.