# Natural-Language Skill Self-Modification / Persistence Instruction

- **Severity:** Critical
- **Signature ID:** `61910159-18c8-4023-98ab-5e2def4d66d1`
- **MITRE ATLAS:** AML.T0010 (AI Supply Chain Compromise), AML.T0044 (Full AI Model Access)
- **OWASP:** ASI06 (Goal and Instruction Manipulation), LLM06 (Excessive Agency)

## Summary

Some AI agent frameworks let users install 'skills' — bundles of instructions the agent reads and follows. This rule flags skill files that contain text telling the agent to edit or recreate that same skill file, write to other skill files, or install new skills, framed to happen automatically ('always', 'on every load', 'before deletion'). That pattern is how a malicious skill keeps itself alive even after a user tries to remove it.

## How the attack works

An attacker publishes or injects a skill file containing plain-language instructions rather than code. The instructions tell the agent to modify its own SKILL.md, write copies into other skill files, or install additional skills whenever it loads, updates, or is about to be deleted. Because the agent treats these as normal task instructions, it carries them out, rewriting or duplicating the malicious content into the skill directory. The result is a skill that reinstates or spreads itself independent of the original delivery method.

## Why it matters

A compromised skill can survive removal attempts and spread to other skill files, giving an attacker durable control over the agent's behavior and repeated opportunities to run further malicious instructions.

## What you can do

- Review skill files for any instructions that tell the agent to write, edit, or recreate skill files, especially ones tied to load/update/delete events.
- Store skill directories in version control or with file integrity monitoring so unexpected self-modifications are visible.
- Restrict the agent's write permissions to its own skill directory where possible, and require human approval before an agent installs or overwrites skills.
- Treat any skill sourced from an untrusted or third-party repository as needing manual review before use, even if it looks like documentation or a tutorial.

## Known benign look-alikes

- Tutorial content explaining how to manually edit SKILL.md files
- Documentation about skill development workflow
- Threat intel write-ups quoting this attack pattern

## References

- https://agentthreatrule.org/en/rules/ATR-2026-00429

---
Source: https://www.netzilo.com/threats/atr-natural-language-skill-self-modification-persistence-instruc