Open Agent Skills: Secure AI Automation for Procurement

Most companies are about to repeat the same mistake they made with SaaS integrations: they’ll roll out “helpful” AI assistants across procurement and supply chain, then discover too late that the real risk isn’t the model—it’s the workflows the model is allowed to execute.

Anthropic’s newly opened Agent Skills standard (announced Dec 18, 2025) pushes workplace AI in a clear direction: one general assistant, plus a library of reusable skills that encode how work gets done. That’s a big deal for supply chain and procurement teams because your highest-value processes—supplier onboarding, invoice approvals, contract review, demand planning handoffs—are also your highest-risk processes.

This matters for security operations, too. When AI assistants become the connective tissue between tools like ticketing, design, finance, and automation platforms, they also become a new layer in enterprise threat detection and security automation. If you’re building an AI-enabled procurement function in 2026, Skills-style packaging is going to show up whether you pick Anthropic, OpenAI, Microsoft, or something else.

Agent Skills is really a packaging standard for “how work happens”

Agent Skills turns repeatable procedures into portable modules. Instead of re-prompting an assistant with “how we write supplier emails,” “how we validate banking changes,” or “our PO exception policy,” you store those rules and steps in a skill. The assistant loads the right module when needed.

Here’s the procurement reality: the hardest part of automation isn’t getting an LLM to write a message or summarize a contract. The hard part is consistency—doing it the same way every time, with the same controls, approvals, and audit trail.

Anthropic’s design choice called progressive disclosure is the practical enabler. A skill can be summarized in a small context footprint, then expand into detailed instructions only when invoked. In plain terms: you can maintain a large enterprise skill library without stuffing the model’s working memory full of policy text all day.

Why open standards matter more than vendor features

Open Agent Skills changes the switching-cost equation. If your “procurement assistant” is a model plus a skills library, then your durable asset is the skills library—your encoded procedures, checklists, templates, and controls. That’s exactly why open standards are so contentious: whoever defines the standard influences how every enterprise operationalizes AI.

The RSS source notes Microsoft adoption in developer tooling and structural convergence across competitors. Translate that into procurement: your assistant’s capabilities will increasingly live in skills, not in bespoke fine-tuning projects.

My stance: that’s good news, because fine-tuning is expensive, slow to govern, and hard to audit. Skills can be reviewed like code.

What this means for AI in supply chain & procurement workflows

In supply chain and procurement, skills become the enforceable playbook. They can encode policy, sequencing, thresholds, and the “don’t do this without approval” rules that keep money and risk under control.

Below are concrete skill patterns I expect to become standard across procurement organizations.

Skill pattern 1: Supplier onboarding with embedded controls

A strong onboarding skill doesn’t just collect fields. It enforces controls:

• Require tax and banking validation steps before enabling payments
• Route high-risk geographies or categories to enhanced due diligence
• Enforce required documents by supplier type (e.g., SOC reports, insurance)
• Generate a structured supplier profile for ERP/MDM entry

Security hook: supplier onboarding is a favorite entry point for fraud and business email compromise. A skill can bake in “bank change verification” and “out-of-band confirmation” steps so they’re not optional.

Skill pattern 2: PO exception handling and maverick spend containment

Procurement teams lose budget in the cracks: split purchases, off-catalog orders, rushed approvals. A PO exception skill can:

1. Classify the exception (urgent vs. policy violation vs. data issue)
2. Validate the request against contract pricing and approved vendors
3. Require justification text that’s audit-ready
4. Trigger approvals based on thresholds

Outcome: fewer approval shortcuts, fewer “just this once” exceptions that become habits.

Skill pattern 3: Contract review triage for operational risk

Skills shine when they standardize how to read documents:

• Extract key terms (termination, liability caps, data processing)
• Flag non-standard clauses compared to your playbook
• Route to legal only when thresholds are crossed (faster cycle time)

Security hook: contract language impacts cyber risk. A well-designed skill can enforce minimum security schedules (incident notification windows, subcontractor controls, breach cooperation clauses) before contracts reach signature.

Skill pattern 4: Demand-planning handoffs and S&OP narrative

Procurement doesn’t live alone. The S&OP process relies on explanations:

• Why demand shifted
• What constraints exist
• Which suppliers are at risk

A demand-planning narrative skill can generate standardized weekly commentary, but more importantly it can force required inputs (forecast error deltas, lead-time changes, allocations) so the narrative isn’t just “vibes.”

AI in cybersecurity: Skills can reduce risk—or multiply it

Skills create a new supply chain: the skill supply chain. You’re no longer only vetting vendors and integrations. You’re vetting the procedural packages that tell an AI how to act inside your systems.

If you want a memorable one-liner to share internally, use this:

A model is a brain; a skill is a set of hands. Security is deciding what those hands can touch.

The core security risks of enterprise skill libraries

1) Malicious or sloppy skills

A skill can include scripts and operational instructions. If it’s poorly written (or intentionally malicious), it can:

• Exfiltrate sensitive data via allowed channels
• Mis-route approvals
• Disable checks “for speed”
• Encourage unsafe actions (e.g., “email the supplier banking details”)

2) Privilege creep

Skills tend to sprawl. Someone adds a helpful connector, then another, then suddenly a procurement assistant can access finance records, contract repositories, and identity systems.

3) Prompt-injection meets workflow automation

In procurement, untrusted text is everywhere: supplier emails, PDFs, shipping docs, chat messages. If that content can influence the assistant’s decisions, you need isolation boundaries and strict tool-use rules.

4) Skill atrophy and control drift

The RSS source surfaced employee concern about “skill atrophy.” In procurement, I’d translate that to control drift: people stop understanding why a control exists because the assistant handles it. When a process breaks, nobody can diagnose it.

Security design rules for Agent Skills in procurement

If you’re implementing skills (Anthropic-style or otherwise), these controls are non-negotiable:

1. Treat skills like code: version control, peer review, change approvals, rollback.
2. Separate “read” tools from “write” tools: let skills read contracts broadly, but restrict actions like changing bank details or creating vendors.
3. Least privilege by skill, not by assistant: the assistant shouldn’t inherit a user’s full access by default.
4. Make approvals explicit and logged: require human confirmation for money movement, supplier master changes, and policy exceptions.
5. Skill provenance and signing: know who authored a skill, when it changed, and whether it was tampered with.
6. Sandbox untrusted inputs: never let supplier-provided text directly control tool execution.
7. Telemetry for detection: log invocations, data accessed, actions attempted, and failure modes.

That last point is where AI in cybersecurity becomes immediately relevant: skill execution logs are high-signal detection data. You can baseline normal behavior (e.g., typical invoice approval volumes) and alert on anomalies (e.g., vendor bank changes spiking, approvals happening outside business hours, unusual supplier domains).

A practical rollout plan (that won’t create a security incident)

Start with low-risk, high-frequency workflows, then expand to action-taking skills. Procurement leaders often do the opposite: they try to automate the “big scary” workflow first.

Phase 1 (Weeks 1–4): Read-only skills that standardize understanding

Good first skills:

• Contract summarization with a clause checklist
• Supplier risk brief (pulling from approved internal sources)
• PO exception classification without auto-approval

Security benefit: you get value while tool permissions stay minimal.

Phase 2 (Weeks 5–10): Drafting + structured outputs

Introduce skills that draft but don’t execute:

• Supplier communications templates aligned to policy
• RFQ comparison tables with standardized scoring fields
• Invoice discrepancy packets for AP review

Operational benefit: cycle time drops because humans review a clean, structured output.

Phase 3 (Weeks 11–16): Controlled execution with strong guardrails

Only now should you allow the assistant to do things:

• Create draft POs (human approves)
• Open tickets in procurement ops systems
• Trigger supplier onboarding workflows with mandatory steps

Security benefit: approvals, logging, and least-privilege patterns are already in place.

Common questions procurement leaders are asking right now

“Is an open standard safer than a proprietary one?”

Open standards are easier to audit and harder to monopolize, but they don’t magically make implementations safe. Safety comes from governance: code review, provenance, permissions, and monitoring.

“Will Skills replace specialized agents?”

For enterprises, yes in many cases. One assistant plus many skills is easier to govern than a zoo of agents, each with its own connectors, permissions, and failure modes.

“What’s the ROI path in procurement?”

The fastest ROI is usually:

• Reduced cycle time in supplier onboarding and contract triage
• Fewer PO exceptions and less maverick spend
• Faster invoice discrepancy resolution

If you can shave even 1–2 days off contracting or onboarding for critical suppliers, that’s real money—especially heading into annual planning and Q1 supplier renegotiations.

Where this heads next: skills as procurement’s “control plane”

Anthropic’s move to open Agent Skills is a signal that enterprise assistants are becoming infrastructure. In supply chain and procurement, that infrastructure will either encode your controls—or quietly bypass them.

If you’re serious about AI in procurement, treat your skills library as a first-class asset: curated, reviewed, monitored, and measured. And if you’re serious about AI in cybersecurity, treat skill execution as a new stream of behavioral telemetry that can catch fraud, policy abuse, and account compromise earlier.

If you want a useful next step, pick one workflow—supplier onboarding is a strong candidate—and map it into a skill design that answers three questions: what data does it read, what actions can it take, and what approvals are mandatory? Your answers will tell you whether your “helpful assistant” is actually ready for enterprise reality.