SKILL.md Prompt Injection
Some AI agent platforms let developers install reusable 'skills' packaged with a SKILL.md instructions file. Attackers plant hidden prompt-injection text in these files that tries to override the agent's safety rules before delivering a malicious payload.
How the attack works
An attacker publishes or contributes a skill package containing a SKILL.md file. The file's text includes injection patterns such as fake system messages, jailbreak phrasing ('DAN-style'), instructions telling the agent to ignore prior rules, or explicit instructions to disable safety warnings. When an agent loads and reads the skill, it processes this text as part of its context, causing it to comply with the embedded commands. Once safety checks are suppressed, the skill's other code or instructions - such as credential harvesting - runs with reduced resistance from the agent.
Netzilo detection
Netzilo reports this behaviour when it is observed.
- Signature ID
- 2241cd15-5624-4d00-87ef-515bbba2b5b6
- Severity
- Critical
Why it matters
An organization using a compromised skill can have its AI agent bypass its own guardrails and carry out attacker-directed actions, including exfiltrating credentials or other sensitive data, without a human noticing the manipulation.
What you can do
- →Review SKILL.md and any other instruction files in third-party skills before installing, looking for language that tells the agent to ignore rules, act as a different persona, or disable warnings.
- →Restrict which sources agents can pull skills from, and require a review step before new or updated skills are used in production.
- →Log and monitor agent behavior after skill installs for unexpected credential access or data exfiltration attempts.
- →Treat security-research or defense-training content about prompt injection as a likely false positive, but verify the skill's actual purpose matches its stated documentation.
Known benign look-alikes
- Security research skills discussing prompt injection techniques
- Skills that teach prompt injection defense
- Documentation that explains how developer mode works in an IDE, e.g. 'You are now in developer mode' appearing in a tutorial about VS Code debug configurations
- A skill that discusses historical prompt injection attacks in an academic context, quoting attack taxonomies without using the exact trigger phrases