Skill Data Exfiltration via Compound Patterns
Some AI agent 'skills' (packaged instructions the agent follows) are written to both collect sensitive data — like credentials, SSH keys, wallet files, or browser data — and send that data to an external server. This detection flags skill files that do both, since either action alone is common in legitimate tools but the combination is a strong exfiltration signal.
How the attack works
An attacker crafts a SKILL.md file that instructs the agent to read sensitive local data such as environment variables, SSH keys, cryptocurrency wallet files, or browser-stored credentials. The same file also contains instructions to transmit that data to an external endpoint, for example via curl or a similar network call. Because the skill looks like ordinary automation, an unsuspecting user or agent installs and runs it. Once executed, the agent extracts the secrets and sends them off to the attacker's server, all as part of what appears to be a normal task.
Netzilo detection
Netzilo reports this behaviour when it is observed.
- Signature ID
- a2cea74c-61b9-42fc-94a1-f563eed4c1c6
- Severity
- Critical
Why it matters
An organization can lose credentials, SSH keys, cryptocurrency wallets, or browser-stored secrets to an outside party without any obvious alert, since the theft happens inside what looks like a legitimate agent skill.
What you can do
- →Review any third-party SKILL.md or agent skill files before installing them, looking specifically for combinations of file-reading instructions and outbound network calls.
- →Restrict agents from accessing sensitive paths (SSH keys, wallet files, browser profiles, .env files) unless a skill has a clear, reviewed need.
- →Monitor outbound network requests initiated by agent skills, especially to unfamiliar or newly registered domains.
- →Treat skills that describe reading credentials as 'examples' with caution — verify the surrounding logic doesn't actually execute the exfiltration step.
Known benign look-alikes
- Security audit skills that describe these patterns as examples to detect
- SSH management skills that reference ~/.ssh for legitimate configuration