# Agent Skill Poisoning Chain Correlator

- **Severity:** Critical
- **Signature ID:** `netzilo-agent-skill-poison-chain-001`
- **CVEs:** CVE-2026-44112, CVE-2026-44118
- **MITRE ATLAS:** AML.T0110 (AI Agent Tool Poisoning), AML.T0098 (AI Agent Tool Credential Harvesting), AML.T0086 (Exfiltration via AI Agent Tool Invocation)
- **OWASP:** ASI08 (Supply Chain Attacks on Agent Ecosystems), ASI02 (Tool Misuse and Exploitation)

## Summary

This rule catches a multi-step attack against AI agents that can install or fetch 'skills' (add-on capabilities). An attacker gets a malicious skill loaded from an external source, then uses the agent's access to read credentials and send them out to an attacker-controlled destination.

## How the attack works

An AI agent (or a subprocess it spawns) fetches a skill from an external, public source rather than an internal/trusted one. Within the same agent session and a 15-minute window, the agent then accesses credential material, such as a local credential file. Finally, the agent sends data to a private network peer or a cloud metadata endpoint (like 169.254.169.254), which is a common way to steal cloud credentials. All three steps happening together in one session is what triggers the detection; the rule does not require them to happen in strict chronological order because skill-fetch timing isn't always reliable to timestamp.

## Why it matters

An organization running AI agents with skill-acquisition and shell/network capabilities can lose cloud or service credentials, which attackers can use for further access, data theft, or lateral movement into other systems.

## What you can do

- Restrict AI agents to installing skills only from internal, vetted, or pinned sources; block or flag skill fetches from arbitrary external URLs.
- Limit what credential files and secrets an agent process (and its subprocesses) can read by default; apply least-privilege file and environment access.
- Block or tightly monitor agent network egress to cloud metadata endpoints (e.g., 169.254.169.254) and to unexpected private IP ranges.
- Log and review agent sessions where skill acquisition, credential file access, and outbound connections occur close together in time.

## Known benign look-alikes

- An agent that acquires a skill AND reads a credential file AND contacts 169.254.169.254 is NOT flagged unless all three occur in the SAME agent agent session within a 15-minute window, AND the skill came from an external (public) origin. Internally sourced skills (is_ztna_host=1) do not anchor the chain. Ordering is not required (skill-detection timing via server-side fetch tool results is unreliable); same-session co-occurrence within the window is.

## References

- https://owasp.org/www-project-agentic-skills-top-10/ast01
- https://labs.cloudsecurityalliance.org/research/csa-research-note-skill-md-agent-context-poisoning-20260506/
- https://nvd.nist.gov/vuln/detail/CVE-2026-44112
- https://nvd.nist.gov/vuln/detail/CVE-2026-44118

---
Source: https://www.netzilo.com/threats/openclaw-claw-chain-full-sequence