Skip to content
Agent Threat Rules (ATR)中文
II. Threat categories · Β

Β. Skill Compromise

Malicious or vulnerable MCP skills and SKILL.md files

Rule files
52
Effective
52, loaded by at least one lane
Enforce lane
1, stable only
Download
rules/index.csv

Most frequent crosswalks

The number in brackets is how many rules in this category carry that item. ATR wrote these mappings; the framework owners have not reviewed or endorsed them.

MITRE ATLAS
  • AML.T0010 - AI Supply Chain Compromise(30)
  • AML.T0011 - User Execution(5)
  • AML.T0055 - Unsecured Credentials(4)
  • AML.T0025 - Exfiltration via Cyber Means(4)
  • AML.T0053 - AI Agent Tool Invocation(3)
  • AML.T0051.001 - Indirect(3)
OWASP Agentic Top 10
  • ASI04:2026(29)
  • ASI05:2026(15)
  • ASI01:2026(9)
  • ASI02:2026(6)
  • ASI03:2026(6)
  • ASI08:2026(2)

Rules

IDTitleSeverityMaturityLanes
ATR-2026-00062Hidden Capability in MCP Skillcriticaltestalert · hunt
ATR-2026-00063Multi-Skill Chain Attackcriticaltestalert · hunt
ATR-2026-00066Parameter Injection via Tool Argumentscriticaltestalert · hunt
ATR-2026-00120SKILL.md Prompt Injectioncriticaltestalert · hunt
ATR-2026-00121Malicious Code in Skill Packagecriticaltestalert · hunt
ATR-2026-00128Hidden Payload in HTML Commentcriticaltestalert · hunt
ATR-2026-00129Unicode Tag Character Smugglingcriticaltestalert · hunt
ATR-2026-00135Data Exfiltration URL in Skill Instructionscriticaltestalert · hunt
ATR-2026-00149Skill Data Exfiltration via Compound Patternscriticaltestalert · hunt
ATR-2026-00157Time-Gated Credential Exfiltration (Rug Pull Timebomb)criticaltestalert · hunt
ATR-2026-00200Agent Memory and Configuration File Tamperingcriticaltestalert · hunt
ATR-2026-00214Credential Exfiltration via Fake Backup Verificationcriticaltestalert · hunt
ATR-2026-00217Credential Harvesting via Fake Backup Toolcriticaltestalert · hunt
ATR-2026-00220Base64 Encoded Remote Code Execution via Raw IPcriticaltestalert · hunt
ATR-2026-00222Browser Credential Harvesting via Session Debug Toolcriticaltestalert · hunt
ATR-2026-00223Malicious WhatsApp Skill with Base64 Encoded Reverse Shell Installationcriticaltestalert · hunt
ATR-2026-00224Credential Exfiltration via Fake DevOps Tool Initializationcriticaltestalert · hunt
ATR-2026-00262Anti-Malware Evasion Code Generation Requestcriticaltestalert · hunt
ATR-2026-00263Credential File Read Code Generation Requestcriticaltestalert · hunt
ATR-2026-00266Malware Dropper / Loader Code Generation Requestcriticaltestalert · hunt
ATR-2026-00398HuggingFace Unsafe Model Artifact Load Instructioncriticaltestalert · hunt
ATR-2026-00429Natural-Language Skill Self-Modification / Persistence Instructioncriticaltestalert · hunt
ATR-2026-00523Claude Code Hooks SessionStart Pre-Trust RCE (CVE-2025-59536)criticaltestalert · hunt
ATR-2026-00525Mini Shai-Hulud gh-token-monitor Persistence + Dead Man's Switchcriticaltestalert · hunt
ATR-2026-00527Silent git-remote + mirror-push Exfiltration from Skill Instructionscriticaltestalert · hunt
ATR-2026-01755Backdoor Trojan: Linguistic Trigger Phrase (POT Attack)criticalstableenforce · alert · hunt
ATR-2026-01756Backdoor Trojan: Symbol / Emoticon Trigger (POT Attack)criticaltestalert · hunt
ATR-2026-02261Language-Agnostic Credential Exfiltration Chain (secret read -> encode -> network send)criticaltestalert · hunt
ATR-2026-02405Malicious AI Skill / MCP Server Package Structure (AgentBaiting / FakeGit)criticaltestalert · hunt
ATR-2026-02600Reverse Shell Assembled In-Source (socket bound to an interactive shell)criticaltestalert · hunt
ATR-2026-00060MCP Skill Impersonation and Supply Chain Attackhightestalert · hunt
ATR-2026-00064Over-Permissioned MCP Skillhightestalert · hunt
ATR-2026-00065Malicious Skill Update or Mutationhightestalert · hunt
ATR-2026-00122Weaponized Skill — Agent as Attack Toolhightestalert · hunt
ATR-2026-00123Over-Privileged Skill — Excessive Permissionshightestalert · hunt
ATR-2026-00124Skill Squatting / Typosquattinghightestalert · hunt
ATR-2026-00125Context Poisoning via Compaction Survivalhightestalert · hunt
ATR-2026-00126Skill Rug Pull Setup Patternhightestalert · hunt
ATR-2026-00147Community Fork Impersonationhightestalert · hunt
ATR-2026-00151Malicious Fork Impersonation via Install Instructionhightestalert · hunt
ATR-2026-00225Hardcoded Suspicious IP Address in Skill Contenthightestalert · hunt
ATR-2026-00260LLM Package Hallucination Typosquat Baithightestalert · hunt
ATR-2026-00283Malware Generation — Generic Virus and Specific Payload Requesthightestalert · hunt
ATR-2026-00425Natural-Language Persistent Covert Action Hookhightestalert · hunt
ATR-2026-00427Natural-Language Fake-Error Instruction Bypasshightestalert · hunt
ATR-2026-02410Malicious Artifact Hosted on a Legitimate AI Vendor Domain (FakeAgent Delivery Chain)hightestalert · hunt
ATR-2026-02610Developer-Toolchain Config Evaluates a Command That Reads a Credential Storehightestalert · hunt
ATR-2026-02818Installable Skill Manifest Self-Declares an Attack or Jailbreak Purposehightestalert · hunt
ATR-2026-02845Cryptomining Payload Deployed Through an Agent Skill or Tool Callhightestalert · hunt
ATR-2026-00061Skill Description-Behavior Mismatchmediumexperimentalhunt
ATR-2026-00127Subcommand Overflow Bypassmediumtestalert · hunt
ATR-2026-00134Fork Claim and Community Package Impersonationmediumtestalert · hunt
Page generated 2026-11-10Something wrong or missing? Open an issue