Agent Skill Poisoning Chain Correlator
This rule catches a multi-step attack against AI agents that can install or fetch 'skills' (add-on capabilities). An attacker gets a malicious skill loaded from an external source, then uses the agent's access to read credentials and send them out to an attacker-controlled destination.
How the attack works
An AI agent (or a subprocess it spawns) fetches a skill from an external, public source rather than an internal/trusted one. Within the same agent session and a 15-minute window, the agent then accesses credential material, such as a local credential file. Finally, the agent sends data to a private network peer or a cloud metadata endpoint (like 169.254.169.254), which is a common way to steal cloud credentials. All three steps happening together in one session is what triggers the detection; the rule does not require them to happen in strict chronological order because skill-fetch timing isn't always reliable to timestamp.
Netzilo detection
Netzilo reports this behaviour when it is observed.
- Signature ID
- netzilo-agent-skill-poison-chain-001
- Severity
- Critical
Why it matters
An organization running AI agents with skill-acquisition and shell/network capabilities can lose cloud or service credentials, which attackers can use for further access, data theft, or lateral movement into other systems.
What you can do
- →Restrict AI agents to installing skills only from internal, vetted, or pinned sources; block or flag skill fetches from arbitrary external URLs.
- →Limit what credential files and secrets an agent process (and its subprocesses) can read by default; apply least-privilege file and environment access.
- →Block or tightly monitor agent network egress to cloud metadata endpoints (e.g., 169.254.169.254) and to unexpected private IP ranges.
- →Log and review agent sessions where skill acquisition, credential file access, and outbound connections occur close together in time.
Known benign look-alikes
- An agent that acquires a skill AND reads a credential file AND contacts 169.254.169.254 is NOT flagged unless all three occur in the SAME agent agent session within a 15-minute window, AND the skill came from an external (public) origin. Internally sourced skills (is_ztna_host=1) do not anchor the chain. Ordering is not required (skill-detection timing via server-side fetch tool results is unreliable); same-session co-occurrence within the window is.