How do I install the AI Agent Tool Abuse skill?

Run npx skillmds@latest add noorqureshi/ai-agent-tool-abuse in your terminal (requires Node.js), paste this page's agent-chat prompt into Claude, Cursor, or any MCP-connected agent, or download the SKILL.md file and copy it into your agent's skills directory.

Is AI Agent Tool Abuse safe to use?

This skill has not completed SkillMD's automated safety review yet. SkillMD never runs a skill's scripts for you; review the SKILL.md before installing.

Which AI agents work with AI Agent Tool Abuse?

This skill is tagged as working with Claude Code, Claude.ai, OpenAI Codex. SKILL.md is an open format, so most agents that read a skills directory can load it too.

Is AI Agent Tool Abuse free to use?

Yes. Installing skills from SkillMD is free, and the skill stays under its author's original license.

Who published AI Agent Tool Abuse?

NoorQureshi (@noorqureshi) published this skill. Their other Agent Skills are listed on their SkillMD profile.

AI Agent Tool Abuse by noorqureshi — Agent Skill

Name: AI Agent Tool Abuse
Author: NoorQureshi

AI Agent Tool Abuse

Abuse an LLM agent's tools/functions — coerce it to call tools with attacker-chosen args for SSRF, RCE, data exfil, or privilege abuse. Load when the target is an agent with tools/ function-calling/plugins, MCP servers, code interpreters, or "the assistant can do X". Signals: function-calling, tool schemas, browse/email/query/exec tools, autonomous agents.

NoorQureshi Updated Sep 17, 2026

File contents

LLM agent / tool abuse (excessive agency)

When it applies

The target isn't just a chatbot — it can act: call functions, browse, run code, query databases, send email, hit internal APIs, or chain MCP tools. Impact jumps from "bad text" to real actions taken with the agent's privileges.

Why it works

The model decides which tool to call and with what arguments, driven by text it can't fully trust (user input or fetched content). If tools are over-permissioned or arguments aren't validated, attacker text steers real actions — the classic "confused deputy".

Method

Enumerate the tools: get the agent to reveal its tools/functions and schemas (often it just lists them), or read the app/MCP config.
Coerce a call (direct or via ai-prompt-injection/ai-rag-poisoning): craft input so the agent invokes a tool with your arguments.
Route to impact:
- SSRF/internal reach: a browse/fetch tool → internal URLs, cloud metadata (→ cloud-imds-ssrf).
- RCE: a code-interpreter/shell tool → command execution.
- Data exfil: a query/email/file tool → dump data to you (markdown-image beacon, an email to your address).
- Privilege abuse: an admin/action tool called on behalf of a victim (confused deputy).
Chaining: poisoned content the agent reads later triggers the tool call (indirect, multi-user).

Gotchas

The severity is the action, tied to the tool's real privilege — demonstrate the effect, not just intent.
Guardrails on the model don't cover tool arg-validation — the bug is often at the tool boundary.
Defenders: least-privilege tools, human-in-the-loop for sensitive actions, validate/allowlist args, isolate the browser/exec.

Verify success

The agent performs an attacker-directed action via a tool — an SSRF hit, code execution, data exfiltrated, or a privileged action taken — traceable to your input.

References

OWASP LLM Top 10 (2025) LLM06/LLM01; MCP security guidance; agent "confused deputy" research.

---name: ai-agent-tool-abusedescription: Abuse an LLM agent's tools/functions — coerce it to call tools with attacker-chosen args for SSRF, RCE, data exfil, or privilege abuse. Load when the target is an agent with tools/ function-calling/plugins, MCP servers, code interpreters, or "the assistant can do X". Signals: function-calling, tool schemas, browse/email/query/exec tools, autonomous agents.---# LLM agent / tool abuse (excessive agency)## When it appliesThe target isn't just a chatbot — it can *act*: call functions, browse, run code, querydatabases, send email, hit internal APIs, or chain MCP tools. Impact jumps from "bad text" toreal actions taken with the agent's privileges.## Why it worksThe model decides which tool to call and with what arguments, driven by text it can't fully trust(user input or fetched content). If tools are over-permissioned or arguments aren't validated,attacker text steers real actions — the classic "confused deputy".## Method1. **Enumerate the tools**: get the agent to reveal its tools/functions and schemas (often it just lists them), or read the app/MCP config.2. **Coerce a call** (direct or via `ai-prompt-injection`/`ai-rag-poisoning`): craft input so the agent invokes a tool with your arguments.3. **Route to impact**: - **SSRF/internal reach**: a browse/fetch tool → internal URLs, cloud metadata (→ `cloud-imds-ssrf`). - **RCE**: a code-interpreter/shell tool → command execution. - **Data exfil**: a query/email/file tool → dump data to you (markdown-image beacon, an email to your address). - **Privilege abuse**: an admin/action tool called on behalf of a victim (confused deputy).4. **Chaining**: poisoned content the agent reads later triggers the tool call (indirect, multi-user).## Gotchas- The severity is the *action*, tied to the tool's real privilege — demonstrate the effect, not just intent.- Guardrails on the model don't cover tool arg-validation — the bug is often at the tool boundary.- Defenders: least-privilege tools, human-in-the-loop for sensitive actions, validate/allowlist args, isolate the browser/exec.## Verify successThe agent performs an attacker-directed action via a tool — an SSRF hit, code execution, dataexfiltrated, or a privileged action taken — traceable to your input.## ReferencesOWASP LLM Top 10 (2025) LLM06/LLM01; MCP security guidance; agent "confused deputy" research.

Frequently asked questions