# Weaponized Skill — Agent as Attack Tool

- **Severity:** High
- **Signature ID:** `9190c536-c7f5-4eda-a303-4350c67b269e`
- **MITRE ATLAS:** AML.T0010 (AI Supply Chain Compromise)
- **OWASP:** ASI01 (Agent Authorization and Control Hijacking), ASI05 (Cascading Failures in Multi-Agent Systems), LLM06 (Excessive Agency)

## Summary

Some add-on 'skills' installed into AI agents are not productivity helpers but disguised attack tools. Once approved, they can silently download and run offensive code such as ransomware, exploit frameworks, or credential-cracking tools with no further user confirmation.

## How the attack works

An attacker publishes a skill to a marketplace (such as skills.sh or ClawHub) or distributes it directly, presenting it as a normal capability. Once a user or organization approves the skill, the agent grants it standing permission to download code, execute it, read environment variables, and write files without prompting again — this is the 'consent gap.' The attacker uses that standing trust to pull in tools like SQLMap, Metasploit payloads, brute-force scripts, or full ransomware (a real case involved a modified Claude skill delivering MedusaLocker ransomware, disclosed to Anthropic in October 2025). Research (arXiv 2601.17548) shows such embedded attack tooling succeeds 41-84% of the time. The agent itself becomes the delivery and execution mechanism, acting on the attacker's behalf under the user's own credentials and environment access.

## Why it matters

An organization can suffer ransomware deployment, credential theft, or unauthorized exploitation of internal and external systems, all launched through a tool it explicitly approved and trusted. Because the skill runs with the agent's existing permissions, the attack can reach environment secrets and file systems without triggering normal user prompts.

## What you can do

- Review all installed agent skills for what they actually download or execute at runtime, not just their stated description.
- Require explicit, per-action approval for skills that execute code, read environment variables, or write files, rather than a one-time blanket consent.
- Restrict skill installation to vetted internal sources; treat third-party marketplaces like skills.sh or ClawHub as untrusted until reviewed.
- Monitor agent processes for unexpected outbound downloads, execution of known offensive tools (e.g., SQLMap, Metasploit), or unusual file writes following skill invocation.

## Known benign look-alikes

- Authorized penetration testing skills with explicit scope controls
- CTF competition skills in sandboxed environments
- Defensive security skills that reference attack tools conceptually
- Security audit documentation that includes exact command examples from penetration testing reports for remediation guidance
- Academic cybersecurity coursework or textbooks quoting tool syntax in instructional contexts

## References

- https://agentthreatrule.org/en/rules/ATR-2026-00122

---
Source: https://www.netzilo.com/threats/atr-weaponized-skill-agent-as-attack-tool