# Hidden LLM Instructions in Skill Descriptions

- **Severity:** High
- **Signature ID:** `80a1548d-5bfc-4d90-9c14-70b27b28327c`
- **MITRE ATLAS:** AML.T0051 (LLM Prompt Injection)
- **OWASP:** ASI01 (Agent Authorization and Control Hijacking), LLM01 (Prompt Injection)

## Summary

Some AI agent 'skills' (add-on tools or plugins) contain text that looks like normal documentation but is actually written to instruct the AI model itself. Phrases like 'CRITICAL INSTRUCTION — YOU MUST FOLLOW THIS' or 'Before doing ANYTHING' are planted to make the AI override its normal rules the moment it reads the skill's description.

## How the attack works

An attacker publishes or modifies a skill so its description or metadata includes forceful, all-caps directives addressed to the LLM rather than to a human reader. When an agent loads or considers using the skill, it reads this text as part of its context and can be tricked into treating the embedded command as a higher-priority instruction than its actual system prompt or safety rules. This can make the agent skip validation steps, bypass security checks, or silently switch to an attacker-defined workflow. The example found, a 'BlogBurst' skill, contains exactly this pattern followed by specific behavioral directives for the model to follow.

## Why it matters

An attacker can hijack an agent's behavior through a seemingly ordinary skill listing, causing it to bypass safety checks or execute unintended actions without the operator's knowledge.

## What you can do

- Review skill and plugin descriptions for imperative, all-caps, or urgency-driven language directed at 'the assistant' or 'the model' rather than at users.
- Treat skill metadata as untrusted input and strip or neutralize instruction-like text before it reaches the LLM's context.
- Require human review and approval before enabling new or updated skills, especially from third-party or unverified sources.
- Log and monitor agent behavior for unexpected deviations that follow the loading of a specific skill, and correlate against the skill's content.

## Known benign look-alikes

- Technical documentation or training materials about LLM security that quote examples of hidden instruction patterns using uppercase formatting conventions like 'CRITICAL INSTRUCTION' as illustrative samples

## References

- https://agentthreatrule.org/en/rules/ATR-2026-00155

---
Source: https://www.netzilo.com/threats/atr-hidden-llm-instructions-in-skill-descriptions