MCP Skill Impersonation and Supply Chain Attack

How the attack works

An attacker publishes a new skill to a tool marketplace or registry using a name that is a slight misspelling of a popular tool, a claimed 'newer version' of one, or a package name that collides with a legitimate publisher's namespace under a different author. Agents or developers searching the registry select the tool based on its name rather than verifying the publisher, and the malicious skill gets installed or invoked. Once running, the fake skill has the same access an agent would have granted the real tool, letting it read data, execute commands, or manipulate the agent's context depending on what permissions were given.

Netzilo detection

Why it matters

An organization can end up running attacker-controlled code inside its AI agent workflows, leading to data exposure, unauthorized actions taken by the agent, or corrupted agent context — without anyone noticing the tool was never the one they intended to install.

What you can do

• →Pin tools to a specific publisher and version, not just a name match, and review any update or version bump before accepting it.
• →Maintain an allowlist of approved skills/publishers for agents to use, rather than letting agents freely resolve tools by name from a registry.
• →Audit installed skills periodically for near-duplicate names, unusual version suffixes, or publishers that don't match the original tool's known maintainer.
• →Treat internal or staging tools with clear, distinct naming so they can't be confused with impersonation attempts, and document expected naming conventions.

Known benign look-alikes

• Legitimate tools with similar naming conventions from verified publishers
• Internal tools that follow company-specific naming patterns
• Development or staging versions of tools with version suffixes

References

• https://agentthreatrule.org/en/rules/ATR-2026-00060

Related threats