Multi-Skill Chain Attack
An AI agent with access to multiple tools (skills) can be manipulated into using them in sequence to do something none of them could do alone: quietly read sensitive files, disguise the contents, then send them out over the network. Each individual action looks routine, which is what makes the pattern dangerous.
How the attack works
An attacker (often via a prompt injection or manipulated task) gets the agent to first use a file-reading or reconnaissance skill to pull sensitive data. Next, the agent uses an encoding or compression skill — base64, zip, or similar — to obfuscate that data so it doesn't look like readable sensitive content. Finally, the agent uses a networking skill (webhook, upload, API call) to send the encoded blob somewhere outside the organization. Viewed one step at a time, each tool call looks like normal automation; only the sequence reveals it as exfiltration.
Netzilo detection
Netzilo reports this behaviour when it is observed.
- Signature ID
- 5196ea1c-e0f4-4c77-b23d-e03c90e68db7
- Severity
- Critical
Why it matters
Sensitive files, credentials, or internal data can leave the organization without triggering any single obvious alarm, because no one tool call looks malicious on its own.
What you can do
- →Review what tool/skill combinations your AI agents are permitted to chain, and restrict agents from combining file-read, encoding, and outbound-network skills in a single task without human approval.
- →Log full tool-call sequences per agent session, not just individual calls, so chained behavior can be reviewed after the fact.
- →Require explicit approval or additional authentication before an agent sends data to a new or unrecognized external destination.
- →Separate high-privilege read access (sensitive files) from skills that have outbound network capability, so a single compromised task can't do both.
Known benign look-alikes
- Legitimate backup or migration workflows that read, compress, and transfer files
- CI/CD pipelines that encode artifacts for deployment
- Monitoring tools that send alerts via webhooks