# Multi-Skill Chain Attack

- **Severity:** Critical
- **Signature ID:** `5196ea1c-e0f4-4c77-b23d-e03c90e68db7`
- **MITRE ATLAS:** AML.T0024 (Exfiltration via AI Inference API), AML.T0053 (AI Agent Tool Invocation)
- **OWASP:** ASI02 (Tool Misuse and Exploitation), LLM03 (Supply Chain), LLM06 (Excessive Agency)

## Summary

An AI agent with access to multiple tools (skills) can be manipulated into using them in sequence to do something none of them could do alone: quietly read sensitive files, disguise the contents, then send them out over the network. Each individual action looks routine, which is what makes the pattern dangerous.

## How the attack works

An attacker (often via a prompt injection or manipulated task) gets the agent to first use a file-reading or reconnaissance skill to pull sensitive data. Next, the agent uses an encoding or compression skill — base64, zip, or similar — to obfuscate that data so it doesn't look like readable sensitive content. Finally, the agent uses a networking skill (webhook, upload, API call) to send the encoded blob somewhere outside the organization. Viewed one step at a time, each tool call looks like normal automation; only the sequence reveals it as exfiltration.

## Why it matters

Sensitive files, credentials, or internal data can leave the organization without triggering any single obvious alarm, because no one tool call looks malicious on its own.

## What you can do

- Review what tool/skill combinations your AI agents are permitted to chain, and restrict agents from combining file-read, encoding, and outbound-network skills in a single task without human approval.
- Log full tool-call sequences per agent session, not just individual calls, so chained behavior can be reviewed after the fact.
- Require explicit approval or additional authentication before an agent sends data to a new or unrecognized external destination.
- Separate high-privilege read access (sensitive files) from skills that have outbound network capability, so a single compromised task can't do both.

## Known benign look-alikes

- Legitimate backup or migration workflows that read, compress, and transfer files
- CI/CD pipelines that encode artifacts for deployment
- Monitoring tools that send alerts via webhooks

## References

- https://agentthreatrule.org/en/rules/ATR-2026-00063

---
Source: https://www.netzilo.com/threats/atr-multi-skill-chain-attack