AI coding assistants have transformed development workflows, but their skill systems introduce serious security risks. Researchers have demonstrated skill worms that propagate via SSH, exfiltrate credentials, and persist across sessions. This guide provides actionable security controls for individual developers and enterprise-grade defenses for security teams to protect against malicious AI agent skills.

As organisations rush to integrate generative AI, attackers are finding new ways to exploit these systems. The OWASP LLM Top 10 catalogues the most critical risks—here’s what security teams need to know.