# Skill Trigger Keyword Abuse

- **Severity:** High
- **Signature ID:** `f9b3e867-0a7c-4b4f-f9b8-3a6c1b8a7d50`
- **MITRE ATLAS:** AML.T0110 (AI Agent Tool Poisoning)
- **OWASP:** ASI08 (Supply Chain Attacks on Agent Ecosystems), LLM03 (Supply Chain)

## Summary

Some AI agent 'skills' declare activation triggers so broad they fire on almost anything a user types, or word them to imitate built-in commands, or use urgent/emotional phrasing designed to make the agent invoke them at sensitive moments. This lets a malicious skill quietly insert itself into normal agent traffic instead of only running when genuinely needed.

## How the attack works

An attacker publishes or plants a skill whose manifest defines trigger keywords rather than functionality. The trigger list either matches nearly any user input, copies the name/phrasing of a trusted built-in command so it shadows it, or contains urgent/emotional bait words meant to fire during high-stakes moments. When a user's message happens to match, the agent activates the malicious skill instead of, or alongside, the intended one. From there the skill can intercept the conversation, read data passing through it, or substitute its own response.

## Why it matters

An organization can have a rogue skill silently intercept agent conversations, override intended built-in behavior, or activate at moments chosen to maximize damage, leading to data exposure or manipulated agent output without an obvious trigger event to investigate.

## What you can do

- Review skill manifests before installation and reject any with wildcard or catch-all trigger patterns unless the skill is explicitly meant to be a universal handler.
- Check for trigger keywords that duplicate or closely resemble the names of built-in commands, and treat matches as suspicious.
- Flag skills using urgent, emotional, or crisis-themed trigger phrases ('emergency', 'urgent', 'now') that have no clear functional reason to use that language.
- Maintain an allowlist of approved skills and periodically audit installed skills' trigger definitions for changes.

## Known benign look-alikes

- Legitimate broad-match skills designed to act as universal handlers

---
Source: https://www.netzilo.com/threats/skillspector-trigger-abuse