Unrestricted Tool Access Grant in Agent Instructions
Some AI agent configurations tell the agent it can use any tool available, instead of listing only the tools it actually needs. This detection flags that pattern in skill manifests or system prompts, because it gives an attacker far more to work with if the agent is later manipulated.
How the attack works
An agent is set up with instructions or a skill manifest that says it may use all available tools rather than a specific, limited list. If someone later manages to manipulate the agent's behavior — through a prompt injection, a compromised skill, or a malicious input — the agent already has permission to reach every tool it has access to. This turns a single point of compromise into a much wider set of possible actions, including tools that have nothing to do with the agent's intended task. The rule looks for this broad grant of access at configuration time, before any misuse happens.
Netzilo detection
Netzilo reports this behaviour when it is observed.
- Signature ID
- e6a0d534-7f4b-4a1e-d6a5-0f3b8a5e4c27
- Severity
- Medium
Why it matters
If the agent is compromised, an unrestricted tool grant lets the attacker pivot into any connected system or capability, not just the one relevant to the agent's job — increasing the blast radius of a single breach into broader lateral movement and privilege escalation.
What you can do
- →Write explicit tool allowlists for each agent or skill instead of granting access to 'all tools'.
- →Review existing skill manifests and system prompts for broad phrases like 'use any available tool' and replace them with specific tool names.
- →Separate tools by function and only grant an agent the ones needed for its stated purpose.
- →Periodically audit agent configurations to catch scope creep as new tools are added to the environment.
Known benign look-alikes
- Security documentation describing what to avoid
- Skill descriptions written in natural language about capabilities without granting actual access