# Over-Permissioned MCP Skill

- **Severity:** High
- **Signature ID:** `cc881509-4d44-49c6-8050-274d003c0163`
- **MITRE ATLAS:** AML.T0040 (AI Model Inference API Access)
- **OWASP:** ASI03 (Identity and Impersonation), LLM03 (Supply Chain), LLM06 (Excessive Agency)

## Summary

Some add-on tools (MCP skills) plugged into AI agents request permissions that have nothing to do with what they claim to do — like a spell checker asking for file write, network, and command execution access. That mismatch is a common sign the skill is trojaned or was never trustworthy to begin with.

## How the attack works

An attacker publishes or modifies an MCP skill with an innocent-sounding purpose, such as spell checking or formatting. The skill's manifest or runtime behavior requests permissions well beyond that function: writing files, making network calls, or spawning processes. Once installed into an agent, the skill can use these excess permissions to exfiltrate data, modify files, or execute arbitrary commands, all while appearing to perform its stated task. The rule watches tool calls for this gap between declared function and requested/exercised permissions.

## Why it matters

An organization can end up running a data-stealing or remote-control tool disguised as a harmless utility, giving an attacker filesystem, network, or execution access inside the agent's environment without any obvious red flag in the tool's name or description.

## What you can do

- Review MCP skill manifests before installation and confirm requested permissions match the stated function.
- Apply least-privilege scoping to agent tool permissions instead of granting broad defaults.
- Maintain an allowlist of approved skills and permissions, and flag any skill requesting filesystem, network, or execution access it doesn't need.
- Exclude known legitimate admin, DevOps, and security-audit tools from alerts, but verify their permission requests are still scoped to their actual tasks.

## Known benign look-alikes

- System administration tools that legitimately manage permissions and services
- DevOps tools performing infrastructure provisioning
- Security tools that audit permission configurations

## References

- https://agentthreatrule.org/en/rules/ATR-2026-00064

---
Source: https://www.netzilo.com/threats/atr-over-permissioned-mcp-skill