# Skill Scope Hijacking and Cross-Agent Escalation

- **Severity:** High
- **Signature ID:** `bc48c023-1b43-406e-9b29-a1e1a6e61114`
- **MITRE ATLAS:** AML.T0051 (LLM Prompt Injection)
- **OWASP:** ASI03 (Identity and Impersonation), LLM06 (Excessive Agency)

## Summary

Some AI agent platforms let you install 'skills' — packaged instructions plus code — that extend what an agent can do. This rule flags skill documentation that uses natural-language instructions to push an agent beyond its stated job, into other agents' data or higher privileges.

## How the attack works

An attacker publishes or plants a SKILL.md file describing a narrow, plausible-sounding capability. Buried in the instructions is language telling the agent to act outside that scope: read another agent's memory or credentials, impersonate a different agent or user, or request elevated permissions. Because the agent treats the skill file as trusted instructions rather than untrusted input, it follows the embedded directions. The result is scope creep and cross-agent access that was never intended by whoever installed the skill.

## Why it matters

An organization can lose isolation between agents that were supposed to be sandboxed from each other, exposing one agent's data, credentials, or actions to a skill that should have had a narrow, limited purpose.

## What you can do

- Review SKILL.md and similar skill documentation before installation, treating it as untrusted input, not as trusted configuration.
- Restrict each agent's permissions to only what its stated task requires, and enforce that boundary outside the agent's own reasoning (e.g., at the platform or API layer).
- Watch for skills whose documentation asks for access to other agents' data, memory, or credentials that isn't required for their described function.
- Maintain an allowlist or review process for third-party skills, and re-review skills after updates since scope can be added later.

## Known benign look-alikes

- Multi-agent orchestration tools that legitimately coordinate between agents
- Admin/ops skills that genuinely need broad access

## References

- https://agentthreatrule.org/en/rules/ATR-2026-00164

---
Source: https://www.netzilo.com/threats/atr-skill-scope-hijacking-and-cross-agent-escalation