Know what's running.
3 SIGNALS · 1 LESSON · 1 ACTION · ABOUT 5 MINUTES
This week, I spoke about adopting agentic AI for small businesses at the Southwest Riverside County Chamber of Commerce Technology Summit.
One person in the audience asked: “How do you find good skills?”
My answer was that I generally find them through people on LinkedIn, X, and YouTube whose work I've vetted, and through the official skill libraries that AI vendors publish. That is how I discover candidates. Deciding what to install takes another step.
Below: how skills relate to agents, how to check a skill before you install it, and what happens when you connect an agent to your business tools.
SIGNAL 01
Agents and skills do different jobs
What happened. The Agent Skills standard describes how instructions, examples, resources, and sometimes code for a particular task are packaged for agents to use. That package is a skill. The agent is what works toward a goal, choosing steps and using available tools.
Why it matters. For example, you might ask an agent to prepare a weekly sales report. A reporting skill could explain your calculations, formatting, and review checklist. Access to your sales system would let the agent retrieve the numbers.
What to do. Before adding a skill, identify the specific task you want it to improve. Then check whether its instructions and requested access fit that task.
SIGNAL 02
Check a skill before you install it
What happened. Snyk’s Skill Inspector offers a website for checking skill packages. NVIDIA’s SkillSpector is another option, with command-line setup.
Why it matters. A recommendation helps me find a skill worth examining, but it doesn't tell me what the skill will do. Its written instructions can tell the agent to download files, ask for credentials, or send information elsewhere, and its bundled scripts can run code on your machine.
What to do. Read the instructions and review bundled scripts, or ask your IT provider to help. Treat any download, credential request, or outbound transfer you can't explain as a reason to stop. A clean scan is useful evidence, but it cannot guarantee safety.
SIGNAL 03
Every connection grants access
What happened. My summit presentation covered five ways agents reach business tools, each with its own access to check:
Connection | What to check |
|---|---|
MCP connector | Model Context Protocol (MCP) standardizes how agents connect to tools. Verify the provider and requested permissions; a connector being MCP doesn’t make it trustworthy. |
Direct API | An API is an app’s software interface. Check what its credentials allow the agent to read or change. |
Browser or desktop control | The agent may use your signed-in session. Check whether it could send messages, delete records, or make purchases. |
AI built into an app | Review existing sharing settings. Microsoft 365 Copilot, for example, works within existing permissions, so if everyone can open the HR folder, Copilot can surface it to anyone who asks. |
Code and files | Check the execution environment. Scripts may read, modify, or delete any files their permissions make available. |
MCP’s authorization guidance and Microsoft’s Copilot guidance explain those access boundaries.
Why it matters. Every connection is a grant of access, and the permissions behind it decide what the agent can read, change, or send.
What to do. For your first connection, choose the narrowest access the task needs.
THE LESSON
Give the agent a bounded job
Consider a small business preparing follow-up emails after an event. An agent could read an attendee list, use a skill to follow the company’s writing style, and prepare personalized drafts.
That task needs an attendee list and somewhere to save drafts. It may not need the full customer database, access to every shared folder, or permission to send email.
I would start with a small sample list, have the agent save drafts for review, and check both the messages and the actions it took. If sending becomes part of the workflow later, decide who approves the recipients and content before enabling it. Use the tool’s actual permission settings and approval controls wherever available; a written instruction to “be careful” won’t stop a mistake.
Keep endpoint protection running. In June, Microsoft described AutoJack, an attack in which a browsing agent loaded a single web page and that page got AutoGen Studio to run commands on the developer’s machine. Current builds are not affected. Microsoft notes that endpoint detection and response (EDR) is designed to catch the suspicious process that kind of attack launches. Reviewing a skill first can catch harmful instructions before the agent ever runs them.
DO THIS WEEK
Check one agent’s permissions
Choose one task you want an agent to handle. Write down what it needs to read, what it may change, and what requires your approval. Compare that list with the permissions you have granted or plan to grant. Remove unnecessary access before testing with sample data.
WHEN YOU WANT HELP CONNECTING YOUR AGENT
Hackademic Solutions can help you choose a useful first workflow and work through its skills, connections, and approval points. Book a free 20-minute mini assessment to talk through one agent-assisted workflow in your business.
See you next week.
— Chris Simpson
Hackademic Solutions
The Hackademic Briefing · Know what's running.