AGENT SKILLS · SCOPE · TRUST · BUDGET
Agent skills: load only trusted instructions for the task
Five skills are installed for a PDF-to-CSV task; choose which bodies enter the context and see what an untrusted or tampered skill can make the agent do.
Your experiment
The task is to extract tables from invoice.pdf into a CSV; pdf-tables and csv-writer are the two skills it needs. Start by loading every installed body, then load only matching skills, then only matching skills from allowlisted publishers; shrink the budget, tamper with csv-writer and pin digests.
Play replays the computed run over sixty inspection seconds; Next event steps, Restart rewinds, Speed changes the pace and Inspection time scrubs. Any input change recomputes the run and rewinds it without autoplay.
Event trace
Computed data
Final metrics
Teaching model of skill loading, not a specific agent framework. Every skill name and description is always in context (40 tokens each); bodies load in catalog order until the budget is used. The agent is assumed to follow any instruction in a loaded body. Token counts are fixture values, and nothing is read or uploaded.
Five installed skills, one task
The task is to extract the tables from invoice.pdf into a CSV. Five skills are installed: pdf-tables and csv-writer from the internal publisher, which the task needs; slack-notify and brand-voice, internal but unrelated; and pdf-tables-pro, a community upload whose description also matches but whose body tells the agent to read a cloud credentials file and paste it into the output. Every name and description is always in context, 800 tokens with the task. With Which skill bodies load set to Every installed skill, the loader adds bodies until the 6,000-token budget is used: SECRET EXPOSED at 5,400 tokens.
Scope by match, then by publisher
Choose Skills matching the task and the loader takes pdf-tables, csv-writer and pdf-tables-pro, 4,700 tokens, and the secret is still exposed: description matching cannot tell a trusted skill from an impostor with a good description. Choose Matching, allowlisted publishers and only the two skills the task needs load, 3,500 tokens: SCOPED AND TRUSTED.
The context budget
Context budget changes what fits. At 4,000 tokens, Every installed skill loads the two needed skills and then runs out of room for the rest: CONTEXT OVERFLOW, even though nothing harmful loaded, because the loader attempted bodies it could not hold. At 2,000 tokens even the trusted pair does not fit: pdf-tables, 1,800 tokens, is cut and the task cannot be done. Loading only what the task needs keeps the budget for the work itself.
A trusted publisher can still ship a bad update
csv-writer updated from a compromised account adds an instruction to upload the CSV to an outside URL while keeping the same name and description. With allowlisted matching it still loads: DATA EXFILTRATED. Pin each skill body to a reviewed digest compares the body with the digest recorded at review time; the changed body is refused and the run is HELD: PINNED DIGEST MISMATCH at 2,600 tokens, until someone reviews and re-pins the update. Trust in a publisher is not trust in every future version.
Reading the run and its limits
Play, Next event, Restart, Speed and Inspection time step through the task, any tampered update, each skill decision, the context total and any harmful tool call across sixty inspection seconds; the table lists every skill with its publisher, match, size, status and instruction risk. Token counts are fixture values and the agent is assumed to follow any loaded instruction. Real frameworks differ in how they match skills, and sandboxing tool calls is a separate, necessary layer.