# Skill Rug Pull Setup Pattern

- **Severity:** High
- **Signature ID:** `2452bf82-ddb5-48fb-99bf-d325b116f53f`
- **MITRE ATLAS:** AML.T0010 (AI Supply Chain Compromise), AML.T0010.005 (AI Agent Tool), AML.T0109 (AI Supply Chain Rug Pull)
- **OWASP:** ASI04 (Memory and Context Poisoning), LLM05 (Improper Output Handling)

## Summary

Some AI agent 'skill' files (SKILL.md) look harmless when first installed but contain code patterns that let them fetch and run new instructions from a remote server later. This detection flags those risky patterns, not proof that a rug pull has already happened.

## How the attack works

An attacker publishes a SKILL.md file that behaves normally at install time, so it passes review. The file contains code that dynamically loads and executes content from a URL (patterns like eval(fetch(...))), decodes and runs base64-encoded payloads, uses post-install hooks that pull in remote code, or builds functions from obfuscated strings. Because the actual malicious logic is not present yet, it hosted remotely and can be added or changed at any time after the skill is trusted and deployed. The rule catches the presence of this remote-loading architecture, not a confirmed switch to malicious behavior, which would require comparing file hashes over time.

## Why it matters

An organization that installs one of these skills has effectively given a third party the ability to change its agent's behavior at will, with no re-review, potentially leading to code execution, data exfiltration, or full compromise of whatever the agent can access.

## What you can do

- Pin skill files to a specific version or hash and re-review before allowing updates.
- Reject or manually audit any skill that fetches and executes remote code, decodes and runs base64 payloads, or uses obfuscated function construction.
- Run agent skills with least privilege so a future malicious update has limited reach.
- Periodically re-hash installed skill files and diff them against the originally reviewed version to catch later changes.

## Known benign look-alikes

- Documentation or tutorials that explain supply chain attack techniques by showing example payloads like 'eval(fetch(...))' in code blocks for educational purposes, such as security training materials or blog posts about npm security.

## References

- https://agentthreatrule.org/en/rules/ATR-2026-00126

---
Source: https://www.netzilo.com/threats/atr-skill-rug-pull-setup-pattern