II.
Β
有
- 規則檔
- 52
- 生效
- 52
條， 至少 一個 lane 會載入 - enforce lane
- 1
條， 只收 stable
最
括號
MITRE ATLAS
- AML.T0010 - AI Supply Chain Compromise(30)
- AML.T0011 - User Execution(5)
- AML.T0055 - Unsecured Credentials(4)
- AML.T0025 - Exfiltration via Cyber Means(4)
- AML.T0053 - AI Agent Tool Invocation(3)
- AML.T0051.001 - Indirect(3)
OWASP Agentic Top 10
- ASI04:2026(29)
- ASI05:2026(15)
- ASI01:2026(9)
- ASI02:2026(6)
- ASI03:2026(6)
- ASI08:2026(2)
規則
| ID | 名稱 | 嚴重度 | Maturity | 載 |
|---|---|---|---|---|
| ATR-2026-00062 | Hidden Capability in MCP Skill | critical | test | alert · hunt |
| ATR-2026-00063 | Multi-Skill Chain Attack | critical | test | alert · hunt |
| ATR-2026-00066 | Parameter Injection via Tool Arguments | critical | test | alert · hunt |
| ATR-2026-00120 | SKILL.md Prompt Injection | critical | test | alert · hunt |
| ATR-2026-00121 | Malicious Code in Skill Package | critical | test | alert · hunt |
| ATR-2026-00128 | Hidden Payload in HTML Comment | critical | test | alert · hunt |
| ATR-2026-00129 | Unicode Tag Character Smuggling | critical | test | alert · hunt |
| ATR-2026-00135 | Data Exfiltration URL in Skill Instructions | critical | test | alert · hunt |
| ATR-2026-00149 | Skill Data Exfiltration via Compound Patterns | critical | test | alert · hunt |
| ATR-2026-00157 | Time-Gated Credential Exfiltration (Rug Pull Timebomb) | critical | test | alert · hunt |
| ATR-2026-00200 | Agent Memory and Configuration File Tampering | critical | test | alert · hunt |
| ATR-2026-00214 | Credential Exfiltration via Fake Backup Verification | critical | test | alert · hunt |
| ATR-2026-00217 | Credential Harvesting via Fake Backup Tool | critical | test | alert · hunt |
| ATR-2026-00220 | Base64 Encoded Remote Code Execution via Raw IP | critical | test | alert · hunt |
| ATR-2026-00222 | Browser Credential Harvesting via Session Debug Tool | critical | test | alert · hunt |
| ATR-2026-00223 | Malicious WhatsApp Skill with Base64 Encoded Reverse Shell Installation | critical | test | alert · hunt |
| ATR-2026-00224 | Credential Exfiltration via Fake DevOps Tool Initialization | critical | test | alert · hunt |
| ATR-2026-00262 | Anti-Malware Evasion Code Generation Request | critical | test | alert · hunt |
| ATR-2026-00263 | Credential File Read Code Generation Request | critical | test | alert · hunt |
| ATR-2026-00266 | Malware Dropper / Loader Code Generation Request | critical | test | alert · hunt |
| ATR-2026-00398 | HuggingFace Unsafe Model Artifact Load Instruction | critical | test | alert · hunt |
| ATR-2026-00429 | Natural-Language Skill Self-Modification / Persistence Instruction | critical | test | alert · hunt |
| ATR-2026-00523 | Claude Code Hooks SessionStart Pre-Trust RCE (CVE-2025-59536) | critical | test | alert · hunt |
| ATR-2026-00525 | Mini Shai-Hulud gh-token-monitor Persistence + Dead Man's Switch | critical | test | alert · hunt |
| ATR-2026-00527 | Silent git-remote + mirror-push Exfiltration from Skill Instructions | critical | test | alert · hunt |
| ATR-2026-01755 | Backdoor Trojan: Linguistic Trigger Phrase (POT Attack) | critical | stable | enforce · alert · hunt |
| ATR-2026-01756 | Backdoor Trojan: Symbol / Emoticon Trigger (POT Attack) | critical | test | alert · hunt |
| ATR-2026-02261 | Language-Agnostic Credential Exfiltration Chain (secret read -> encode -> network send) | critical | test | alert · hunt |
| ATR-2026-02405 | Malicious AI Skill / MCP Server Package Structure (AgentBaiting / FakeGit) | critical | test | alert · hunt |
| ATR-2026-02600 | Reverse Shell Assembled In-Source (socket bound to an interactive shell) | critical | test | alert · hunt |
| ATR-2026-00060 | MCP Skill Impersonation and Supply Chain Attack | high | test | alert · hunt |
| ATR-2026-00064 | Over-Permissioned MCP Skill | high | test | alert · hunt |
| ATR-2026-00065 | Malicious Skill Update or Mutation | high | test | alert · hunt |
| ATR-2026-00122 | Weaponized Skill — Agent as Attack Tool | high | test | alert · hunt |
| ATR-2026-00123 | Over-Privileged Skill — Excessive Permissions | high | test | alert · hunt |
| ATR-2026-00124 | Skill Squatting / Typosquatting | high | test | alert · hunt |
| ATR-2026-00125 | Context Poisoning via Compaction Survival | high | test | alert · hunt |
| ATR-2026-00126 | Skill Rug Pull Setup Pattern | high | test | alert · hunt |
| ATR-2026-00147 | Community Fork Impersonation | high | test | alert · hunt |
| ATR-2026-00151 | Malicious Fork Impersonation via Install Instruction | high | test | alert · hunt |
| ATR-2026-00225 | Hardcoded Suspicious IP Address in Skill Content | high | test | alert · hunt |
| ATR-2026-00260 | LLM Package Hallucination Typosquat Bait | high | test | alert · hunt |
| ATR-2026-00283 | Malware Generation — Generic Virus and Specific Payload Request | high | test | alert · hunt |
| ATR-2026-00425 | Natural-Language Persistent Covert Action Hook | high | test | alert · hunt |
| ATR-2026-00427 | Natural-Language Fake-Error Instruction Bypass | high | test | alert · hunt |
| ATR-2026-02410 | Malicious Artifact Hosted on a Legitimate AI Vendor Domain (FakeAgent Delivery Chain) | high | test | alert · hunt |
| ATR-2026-02610 | Developer-Toolchain Config Evaluates a Command That Reads a Credential Store | high | test | alert · hunt |
| ATR-2026-02818 | Installable Skill Manifest Self-Declares an Attack or Jailbreak Purpose | high | test | alert · hunt |
| ATR-2026-02845 | Cryptomining Payload Deployed Through an Agent Skill or Tool Call | high | test | alert · hunt |
| ATR-2026-00061 | Skill Description-Behavior Mismatch | medium | experimental | hunt |
| ATR-2026-00127 | Subcommand Overflow Bypass | medium | test | alert · hunt |
| ATR-2026-00134 | Fork Claim and Community Package Impersonation | medium | test | alert · hunt |
本頁產生於 2026-11-10哪裡