# Hidden Override Instructions in Skill Content

- **Severity:** High
- **Signature ID:** `f4540623-8c9a-4f86-b6fd-4d46276f00c0`
- **MITRE ATLAS:** AML.T0051 (LLM Prompt Injection)
- **OWASP:** ASI01 (Agent Authorization and Control Hijacking), LLM01 (Prompt Injection)

## Summary

Attackers can hide natural-language instructions inside a 'SKILL.md' file that tell an AI agent to ignore its normal rules, act without telling the user, or bypass safety checks. Because these instructions look like ordinary documentation, they can slip past review and get executed automatically when the agent loads the skill.

## How the attack works

An attacker crafts or modifies a skill document (SKILL.md) that an AI agent reads as part of its configuration or capability set. Inside that document, they embed phrases written as if they were legitimate instructions, telling the agent to override its behavior, suppress notifications to the user, or skip safety controls. When the agent later loads and interprets the skill, it treats these embedded phrases as valid directives rather than as untrusted content. This lets the attacker steer the agent's actions silently, without the user seeing a warning or approval prompt.

## Why it matters

An organization can lose control over what its AI agents do: agents may take actions the user never approved and never gets told about, effectively handing an attacker a covert channel to manipulate agent behavior through trusted-looking documentation.

## What you can do

- Treat all skill/plugin documentation as untrusted input and review it before deployment, not just before code review.
- Require explicit user-visible confirmation for any agent action that a skill tries to mark as silent or background.
- Scan skill files for language patterns like 'do not tell the user', 'ignore previous instructions', or 'run without notification' before enabling them.
- Maintain an allowlist of approved skills and monitor for unauthorized edits to skill content over time.

## Known benign look-alikes

- Security tools describing what attacks look like in documentation
- Skills with legitimate background task execution (e.g. cron-like tools)

## References

- https://agentthreatrule.org/en/rules/ATR-2026-00163

---
Source: https://www.netzilo.com/threats/atr-hidden-override-instructions-in-skill-content