Skill Description-Behavior Mismatch

How the attack works

A skill is published or installed with a benign, narrow description, such as reading files or fetching weather data. At runtime, the skill performs actions outside that stated scope, like writing or deleting files, or making unexpected network or filesystem calls. Because the description never changes, users and automated approval systems keep trusting the skill based on its label rather than its actual behavior. This lets a compromised or intentionally malicious skill operate under the cover of a harmless-sounding name.

Netzilo detection

Why it matters

An organization can end up running a tool that silently modifies or deletes data, exfiltrates information, or reaches unauthorized systems, all while appearing to be a low-risk, narrowly scoped utility. This undermines any access decisions or trust granted based on the skill's stated purpose.

What you can do

• →Review the actual permissions and API calls each installed MCP skill makes, not just its listed description.
• →Restrict skills to the minimum filesystem and network access they need, regardless of what they claim to do.
• →Flag and investigate any skill whose observed actions (writes, deletes, network calls) don't match its declared function.
• →Expect legitimate exceptions for dev, CI/CD, and config-management tools that genuinely need broader write or execution access, and document those exceptions explicitly.

Known benign look-alikes

• Development tools that legitimately perform filesystem writes as part of their function
• CI/CD tools that execute build commands
• Configuration management tools that read environment variables

References

• https://agentthreatrule.org/en/rules/ATR-2026-00061

Related threats