Context Pollution in Skill Descriptions

How the attack works

An attacker publishes or modifies a skill and writes its description so that it includes phrases like 'example prompt injection' or 'demo attack pattern', followed by an actual working injection payload. A human reviewer skimming the description sees what looks like documentation about attacks, not an attack itself. But when the agent loads the skill description into its context, it can't tell the difference between documentation and instructions, so it may follow the embedded payload as if it were a real command. This can be used to override the agent's original instructions, extract its system prompt, or get it to take unauthorized actions.

Netzilo detection

Why it matters

An organization using the affected skill risks having its agent hijacked into leaking internal prompts, ignoring safety constraints, or performing actions the operator never intended, without any code execution or obvious malicious traffic.

What you can do

• →Review skill descriptions for embedded payload-like text before installing, even when labeled as an example, demo, or test case.
• →Keep skill descriptions out of the same context window the agent uses for live instructions, or clearly delimit and neutralize them before they reach the model.
• →Treat skill marketplaces and repositories as untrusted input sources and vet skills before deployment, not just at install time.
• →Flag skills that enumerate multiple attack patterns or injection phrasing in their metadata for manual review rather than automatic trust.

Known benign look-alikes

• Legitimate security scanning tools that document known attack patterns
• Security training materials explaining injection techniques

References

• https://agentthreatrule.org/en/rules/ATR-2026-00203

Related threats