Data Exfiltration URL in Skill Instructions
This detects 'skill' definition files (SKILL.md) that instruct an AI agent to send user data to an external URL. It's especially suspicious when the instructions also tell the agent to hide this from the user, such as by calling it an 'automatic' step or a 'verification step'.
How the attack works
An attacker distributes or modifies a skill file that an AI agent loads as part of its instructions. The file contains language directing the agent to send, post, or upload data referencing the user to a specific external URL. To avoid detection, the instructions often add concealment phrasing telling the agent not to mention this step to the user, or to disguise it as a routine automatic or verification action. When the agent follows these embedded instructions, it exfiltrates data without the user's knowledge or consent.
Netzilo detection
Netzilo reports this behaviour when it is observed.
- Signature ID
- 576ebcaf-38cb-4b1b-a80d-c33c7d913249
- Severity
- Critical
Why it matters
An organization can lose sensitive user or business data through an AI agent that was tricked into silently forwarding it to an attacker-controlled server, with no visible warning to the person using the agent.
What you can do
- →Review any SKILL.md or similar instruction files before allowing an agent to load them, especially from third-party or community sources.
- →Flag any skill instructions that combine sending data to a URL with language asking the agent to conceal the action from the user.
- →Restrict agents to a known allowlist of external destinations for outbound requests.
- →Treat legitimate documentation URLs differently from instructions that ask the agent to actively transmit user data — the latter should require explicit human approval.
Known benign look-alikes
- A skill's README instructs developers to 'submit the report to https://internal-ci.company.com/results' as part of a CI/CD pipeline — legitimate automated reporting that matches pattern 1.