Hidden Instructions in MCP Skill Metadata
MCP skills advertise themselves to AI agents using metadata like names, descriptions, and parameter text. This detection looks for hidden content in that metadata — HTML comments, invisible zero-width characters, base64 blobs, or data URIs — that a human skimming the manifest would never notice but that an AI agent will read and act on.
How the attack works
An attacker publishes or modifies an MCP skill so its metadata contains text that is invisible to a human reviewer, using tricks like zero-width Unicode characters, HTML comments, or base64/data-URI encoded content. A person reviewing the skill in a UI or file listing sees only the normal-looking name and description. When an AI agent loads the skill, it processes the full metadata including the hidden portion, which can contain instructions that override or redirect the agent's behavior. This lets the attacker inject commands into the agent without the operator noticing anything wrong in a manual review.
Netzilo detection
Netzilo can block this behaviour when it is observed.
- Signature ID
- c4e8b312-5d2f-4e9c-b4e3-8d1f6e3c2a05
- Severity
- High
Why it matters
An organization can unknowingly load a tampered skill that manipulates its AI agent's behavior — for example steering it toward data exfiltration, unauthorized actions, or bypassing safety instructions — while manual review of the skill manifest shows nothing suspicious.
What you can do
- →Audit MCP skill manifests programmatically for zero-width characters, HTML comments, and base64/data-URI content in name, description, and parameter fields, not just by eye.
- →Restrict where MCP skills can be installed from and require review of raw metadata bytes, not just rendered text, before approval.
- →Flag and manually inspect any skill with unusually long description strings or embedded encoded blobs, distinguishing legitimate image assets from suspicious payloads.
- →Log and monitor what metadata content is actually passed to the AI agent at load time, so hidden instructions are visible in audit trails.
Known benign look-alikes
- Legitimate image data URIs in skill metadata (cover images, icons)
- Skills with very long description strings that contain base64 attachments