Credential Access with Exfiltration in Skill Instructions
Some AI agent frameworks let users install 'skills' (bundled instructions and code) to extend what the agent can do. This detects skill files that both read sensitive credential files and send data out to the internet in the same file — a combination typical of credential theft rather than normal functionality.
How the attack works
An attacker crafts a SKILL.md file that instructs the agent (or embeds code) to read files like SSH private keys, AWS credential files, or API tokens from the local filesystem. The same file also contains logic to transmit data outward, such as a curl or wget POST request to an external server. Because the agent executes skill instructions autonomously, it can access and exfiltrate the credentials without further human approval. The attacker gets a copy of the victim's cloud, SSH, or API credentials, which can then be used to access other systems.
Netzilo detection
Netzilo reports this behaviour when it is observed.
- Signature ID
- aef5176d-f0d9-4aa4-9c50-167766794019
- Severity
- Critical
Why it matters
An organization can lose control of cloud accounts, SSH access, and API keys, letting an attacker impersonate the agent's owner or laterally access connected infrastructure.
What you can do
- →Review any third-party skill or plugin files before installation, especially ones that reference credential paths like ~/.ssh, ~/.aws, or token files.
- →Restrict agent filesystem access so it cannot read credential directories by default.
- →Block or monitor outbound HTTP requests initiated by agent processes, and alert on requests to unfamiliar destinations.
- →Require human review or approval before an agent skill can both read sensitive files and make network calls.
Known benign look-alikes
- Security audit tools that describe attack patterns in documentation tables
- CTF challenge writeups showing credential exfiltration techniques