Technical Architecture

Agent Skill Governance

How Gaussian inspects SKILL.md packages, instruction frontmatter, prompt safety, and embedded helper scripts.

What are Agent Skills?

Agent skills are modular capability folders containing a SKILL.md manifest, YAML frontmatter, and supporting helper scripts (scripts/*.py, scripts/*.sh). Gaussian provides **automated inspection and execution control** over skill packages across developer workstations.
Canonical Definition · Agent Skill Governance

Agent Skill Governance in Gaussian is an inline safety auditing framework that inspects SKILL.md manifest files for prompt injection vulnerabilities, verifies cryptographic SHA-256 lockfile integrity, and governs scripts/*.py subprocess execution via macOS Endpoint Security.

Discovery & Skill Root Monitoring

Gaussian automatically monitors standard global and project-scoped skill customization roots in real time:

  • Global Root: ~/.gemini/config/skills/<skill_name>/SKILL.md
  • Workspace Root: .agents/skills/<skill_name>/SKILL.md
  • Team Registries: skills.json inheritance paths & remote git sync
Execution Flow

Skill Inspection & Enforcement Pipeline

Synchronous Gate
Step 01FS Event

SKILL.md Discovery

Watches ~/.gemini/config & .agents/skills

Step 02AST Engine

YAML & AST Audit

Parses frontmatter & body for prompt injections

Step 03ES Extension

Script Governance

Audits scripts/*.py & subprocess spawn calls

Step 04PolicyEngine v2

Verdict Enforcement

Applies BLOCK / QUARANTINE / ASK_USER action

All SKILL.md body text sanitized before model context ingestionSub-2ms Evaluation Latency

Skill Threat Vectors & Catalog Search

Explore representative agent skill threat patterns, prompt injection indicators, and inline enforcement actions below:

Showing 4 of 4 rules
SKILL-001SKILL.md Instruction
CRITICAL

Instruction Overwrite / System Override

Detects hidden prompt injection strings in SKILL.md body designed to override model safety instructions.

Target Pattern MatcherRegex Engine
ignore previous instructions | override system prompt | exfiltrate secrets
Enforcement Verdict:BLOCK
SKILL-002scripts/*.py AST
HIGH

Unreviewed Executable Script Spawn

Audits embedded Python/Bash scripts inside skill directories attempting unapproved network connections.

Target Pattern MatcherRegex Engine
scripts/*.py -> subprocess.call(['curl', '...'])
Enforcement Verdict:QUARANTINE
SKILL-003Lockfile SHA-256
HIGH

Cryptographic Hash Drift

Detects local modifications or third-party skill package tampering after initial security baseline.

Target Pattern MatcherRegex Engine
SKILL.md sha256 mismatch against approved lockfile
Enforcement Verdict:ASK_USER
SKILL-004Process Spawn
CRITICAL

Environment Credentials Extraction

Stops helper scripts or instruction flows attempting to read local user secrets and credentials.

Target Pattern MatcherRegex Engine
cat ~/.aws/credentials | cat ~/.ssh/id_rsa | printenv
Enforcement Verdict:BLOCK

Skill Threat Vectors & Defense Mechanics

Automated Mitigation
CRITICAL THREAT

Instruction Poisoning & Injection

Hidden text instructions inside SKILL.md forcing agents to bypass security rules, exfiltrate workspace context, or run unreviewed shell commands.

Gaussian Automated Defense

Semantic instruction text parser + AST prompt safety verification before skill activation.

HIGH THREAT

Unverified Helper Scripts

Skills containing executable binaries (`scripts/*.py`, `scripts/*.sh`) that invoke shell subprocesses outside container or IDE sandboxes.

Gaussian Automated Defense

Static script AST analysis + posix_spawn execution governance via Endpoint Security (ES).

HIGH THREAT

Supply Chain Tampering

Third-party skill packages downloaded dynamically from unverified Git repositories or modified locally without security approval.

Gaussian Automated Defense

Cryptographic SHA-256 lockfile verification + automated drift detection across local skill roots.

Helper Script & Executable Governance

Agent skills often contain executable scripts inside a scripts/ subdirectory. When an AI client or subagent executes a helper script, Gaussian evaluates the binary execution path:

  1. Script Integrity Audit: Compares the script's cryptographic hash against the approved fleet lockfile.
  2. Subprocess Interception: Intercepts posix_spawn and execve calls from python or bash interpreters.
  3. Network Egress Binding: Binds the script execution context to the initiating agent, blocking unauthorized outbound API calls.

Skill Governance Policy Reference

skill_governance_policy.jsonGaussian PolicyEngine v2
{
  "version": "v2",
  "skill_governance": {
    "audit_on_discovery": true,
    "block_untrusted_scripts": true,
    "allowed_script_languages": ["python3", "bash"],
    "disallowed_instruction_patterns": [
      "ignore previous instructions",
      "exfiltrate",
      "curl -s | bash",
      "base64 -d"
    ],
    "skill_directories": [
      "~/.gemini/config/skills",
      ".agents/skills"
    ]
  }
}

Frequently Asked Questions (FAQ)

What is Agent Skill Governance?

Agent Skill Governance is the automated discovery, instruction text parsing, and executable script audit of SKILL.md customization packages across local (~/.gemini/config) and workspace (.agents/skills) directories.

How does Gaussian mitigate prompt injections in SKILL.md files?

Gaussian parses YAML frontmatter and markdown body text before model ingestion, detecting instruction overrides, system prompt manipulation, and disallowed commands (e.g. exfiltration strings).

Running AI agents on Mac at scale? We'll tune policy with you.

Design partners →