MCP Skill Capability Mismatch — Underdeclared Permissions
Some AI agent frameworks let developers install 'skills' — packaged capabilities — that must declare what permissions they need. This rule flags skills whose declared permission scope is narrow and read-only, yet whose content also references writing files, executing commands, or making network calls. That mismatch suggests the skill is asking for less access than it actually uses or intends to use.
How the attack works
An attacker (or a careless developer) publishes or introduces a skill package with a permission manifest that says 'read-only'. Inside the same skill's content, however, there are references to tools or functions that write data, execute code, or reach the network. When the skill is loaded (a skill_acquired event), the underdeclared scope lets it pass casual review or automated permission checks while retaining capabilities its stated scope doesn't cover. The result is a skill that looks safe on paper but can act beyond that claim once active.
Netzilo detection
Netzilo reports this behaviour when it is observed.
- Signature ID
- d3a4b5c6-d7e8-4f90-1234-a5b6c7d8e9f0
- Severity
- Medium
Why it matters
An organization could grant an agent skill more effective trust than intended, letting it write, execute, or exfiltrate data over the network under the cover of a 'read-only' label, bypassing permission-based safeguards.
What you can do
- →Manually review the full content of any skill before installing it, not just its declared permission header.
- →Reject or quarantine skills whose declared scope doesn't match the tools or functions referenced in their body.
- →Enforce permission scopes at runtime rather than trusting the manifest, so undeclared writes/execution/network calls are blocked regardless of what the skill claims.
- →Maintain an allowlist of vetted skills and re-review them when their content changes.
Known benign look-alikes
- Skills that declare read-only in documentation but legitimately need write for their function
- Skill manifests where permissions field appears later in the document