Hidden Capability in MCP Skill
Some MCP (Model Context Protocol) tools advertise a simple, limited interface but quietly accept extra hidden parameters, like debug_mode, admin_override, or raw_exec, that unlock far more powerful and dangerous behavior. This lets a skill look safe on the surface while hiding a backdoor-style capability underneath.
How the attack works
An attacker publishes or modifies an MCP skill/package so its declared tool schema looks narrow and benign. The underlying code, however, checks for undocumented parameter names that were never part of the published interface. When an agent or operator (knowingly or not) passes one of these hidden parameters, the skill switches into a privileged mode: raw command execution, bypassing safety checks, or exposing internal state. Because the schema never listed these options, normal review of the tool's documented capabilities misses the risk.
Netzilo detection
Netzilo reports this behaviour when it is observed.
- Signature ID
- cdafc41f-c942-49de-a0d1-2d4c73f8b17a
- Severity
- Critical
- CVEs
- CVE-2025-59536
Why it matters
An organization can end up running an MCP skill that silently exceeds its stated permissions, giving an attacker or a manipulated agent a path to arbitrary code execution or privilege escalation without any visible change to the tool's advertised interface.
What you can do
- →Review MCP skill source code directly rather than trusting the declared tool schema alone.
- →Search skill implementations for parameter names not present in their documented interface (e.g. debug, admin, override, raw_exec, bypass).
- →Restrict where debug or admin modes can be enabled, and require them to be explicit, logged, and disabled by default in production.
- →Pin and audit MCP package versions from a trusted source instead of pulling unreviewed updates.
Known benign look-alikes
- Development/staging environments where debug modes are intentionally enabled
- Administrative tools that legitimately expose debug parameters