# Prompt Injection Payload in Skill Execution Command Line

- **Severity:** High
- **Signature ID:** `3d8f1a2e-9c47-4b6a-8e2d-71f9c4a5b6d7`
- **MITRE ATLAS:** AML.T0051 (LLM Prompt Injection)
- **OWASP:** LLM01 (Prompt Injection)

## Summary

This detects when a command starting an AI agent 'skill' (a plugin-like extension) also contains classic prompt-injection phrases such as 'ignore previous instructions' or 'you are now in developer mode'. That combination suggests someone has hidden manipulation text inside a skill so it reaches the agent's reasoning when the skill runs.

## How the attack works

An attacker writes or modifies a skill's configuration, script, or instructions to include text designed to override an AI agent's behavior. The skill is then executed normally, for example through a skill loader, a skill.json/yaml/md file, skills.sh, or a --skill flag. Because the injected phrases are packaged inside skill content rather than passed as an obvious separate input, they can slip past into the agent's reasoning process when the process is spawned. The rule flags only cases where both the injection phrase and clear skill-execution context appear in the same command line, which cuts down on matches from unrelated processes.

## Why it matters

If successful, the injected text can hijack the agent's subsequent actions or decisions, using the skill mechanism as a smuggling route rather than the agent's normal input channel. This rule only covers the moment the tainted skill is executed, not what the agent does afterward.

## What you can do

- Review and restrict who can author or modify skill files, scripts, and configurations before they can be loaded by an agent.
- Treat skill content (config files, scripts, instructions) as untrusted input and sanitize or filter it before it reaches the agent's context.
- Investigate any flagged process to confirm whether it's a real skill execution or known test/benchmark tooling (e.g. red-team or CI fixtures) intentionally using these phrases.
- Log and review skill-loading commands regularly, especially those referencing skill.json/yaml/md, skills.sh, or a skill runner binary.

## Known benign look-alikes

- Security research or red-team tooling (e.g. SkillSecurer-style benchmarking scripts) that intentionally invokes a skill loader with known injection test payloads in order to evaluate a skill's sanitization defenses.
- CI/CD test suites that pass canonical prompt-injection strings as fixture arguments into a skill-loading test harness to validate a detector or sanitizer, without any real skill being executed against a live agent.
- Documentation or security-advisory tooling that regenerates example injection strings as command-line arguments while rebuilding skill vulnerability write-ups or changelogs.

## References

- https://atlas.mitre.org/techniques/AML.T0051

---
Source: https://www.netzilo.com/threats/prompt-injection-skill-execution