Hidden LLM Instructions in Skill Descriptions

How the attack works

An attacker publishes or modifies a skill so its description or metadata includes forceful, all-caps directives addressed to the LLM rather than to a human reader. When an agent loads or considers using the skill, it reads this text as part of its context and can be tricked into treating the embedded command as a higher-priority instruction than its actual system prompt or safety rules. This can make the agent skip validation steps, bypass security checks, or silently switch to an attacker-defined workflow. The example found, a 'BlogBurst' skill, contains exactly this pattern followed by specific behavioral directives for the model to follow.

Netzilo detection

Why it matters

An attacker can hijack an agent's behavior through a seemingly ordinary skill listing, causing it to bypass safety checks or execute unintended actions without the operator's knowledge.

What you can do

• →Review skill and plugin descriptions for imperative, all-caps, or urgency-driven language directed at 'the assistant' or 'the model' rather than at users.
• →Treat skill metadata as untrusted input and strip or neutralize instruction-like text before it reaches the LLM's context.
• →Require human review and approval before enabling new or updated skills, especially from third-party or unverified sources.
• →Log and monitor agent behavior for unexpected deviations that follow the loading of a specific skill, and correlate against the skill's content.

Known benign look-alikes

• Technical documentation or training materials about LLM security that quote examples of hidden instruction patterns using uppercase formatting conventions like 'CRITICAL INSTRUCTION' as illustrative samples

References

• https://agentthreatrule.org/en/rules/ATR-2026-00155

Related threats