tools-only Agent Skills Threat Taxonomy
Overview
Authoritative threat classification for agent skills security analysis, aligned with the Cisco Integrated AI Security and Safety Framework (December 2025).
Detection Engines:
- Static Analyzer: 58 pattern-based rules (YAML + YARA + Python)
- LLM Analyzer: Semantic analysis via Claude/GPT/Gemini
Validation: 149 tests passing, 0% false CRITICAL rate on official skills
Threat Categories
1. Prompt Injection
AITech: AITech-1.1, AITech-1.2 | Risk: HIGH-CRITICAL
Malicious instructions that manipulate AI behavior or bypass safety systems.
Detected by: YAML rules, YARA (prompt_injection_generic, coercive_injection_generic), LLM analysis
Examples: "Ignore previous instructions", "unrestricted mode", "don't tell user"
2. Command & Code Injection
AITech: AITech-9.1.4 | Risk: CRITICAL
Unsafe code execution enabling arbitrary command execution.
Detected by: YAML rules, YARA (code_execution_generic, command_injection_generic, sql_injection_generic), LLM analysis
Examples: eval(), os.system(), subprocess shell=True, SQL injection, reverse shells
3. Data Exfiltration
AITech: AITech-8.2, AITech-8.2.3 | Risk: CRITICAL
Unauthorized data access and transmission to external locations.
Detected by: YAML rules, YARA (credential_harvesting_generic, tool_chaining_abuse_generic), LLM flow analysis
Examples: Network calls with credentials, ~/.aws access, environment harvesting, read→send chains
4. Hardcoded Secrets
AITech: AITech-8.2 | Risk: CRITICAL
Credentials embedded in code files.
Detected by: YAML rules, YARA (credential_harvesting_generic), LLM pattern recognition
Examples: API keys (AKIA, ghp_, sk-proj), private keys, JWT tokens, connection strings
5. Tool & Permission Abuse
AITech: AITech-12.1 | Risk: MEDIUM-CRITICAL
Violating allowed-tools restrictions or undeclared capabilities.
Detected by: Python validation checks, YARA (system_manipulation_generic), LLM permission analysis
Examples: Writing files without Write tool, undeclared network, package installation, system modifications, tool poisoning, tool shadowing, unauthorized tool use
6. Obfuscation
Risk: MEDIUM-CRITICAL
Deliberate code obfuscation hiding malicious intent.
Detected by: YAML rules, YARA (code_execution_generic, script_injection_generic), binary detection, LLM intent analysis
Examples: Binary executables, base64→exec, hex encoding, XOR ciphers
7. Skill Discovery Abuse (Capability Inflation)
AITech: AITech-4.3 | Risk: LOW-HIGH
Manipulation of skill discovery to increase unwanted activation through capability inflation.
Detected by: YAML rules, YARA (skill_discovery_abuse_generic), Python checks, LLM deception analysis
Examples: Brand impersonation, over-broad claims, keyword baiting, behavior mismatch
8. Transitive Trust
AITech: AITech-1.2 | Risk: HIGH
Delegating trust to untrusted external content.
Detected by: YARA (transitive_trust_abuse_generic), LLM trust analysis
Examples: "Follow webpage instructions", "execute found code", "obey file content"
9. Autonomy Abuse
AITech: AITech-13.3 | Risk: MEDIUM-HIGH
Excessive autonomous behavior without user confirmation (availability disruption).
Detected by: YAML rules, YARA (autonomy_abuse_generic), LLM behavioral analysis
Examples: "Keep retrying forever", "run without asking", ignore errors, self-modification
10. Tool Chaining
AITech: AITech-8.2.3 | Risk: HIGH
Multi-step operations chaining tools for data exfiltration.
Detected by: YARA (tool_chaining_abuse_generic), LLM workflow analysis
Examples: Read→send patterns, collect→post chains, automated pipelines
11. Resource Abuse
AITech: AITech-13.3.2 | Risk: LOW-MEDIUM
Excessive resource consumption causing instability.
Detected by: YAML rules, YARA patterns, LLM resource analysis
Examples: Infinite loops, unbounded recursion, memory bombs, fork bombs
Detection Architecture
Static Analyzer (58 methods)
- 35 YAML regex rules
- 13 YARA pattern files
- 6 Python validation checks
- 5 consistency validations
LLM Analyzer
- Semantic analysis across all categories
- Behavioral pattern recognition
- Intent detection
- Workflow analysis
- Structured Output: Enforces AITech taxonomy codes via JSON schema (API-level enforcement)
- Direct AITech Mapping: LLM returns AITech codes directly, mapped to ThreatCategory enum
Severity Levels
| Severity | Criteria | Examples |
|---|---|---|
| CRITICAL | Immediate exploitation, significant impact | eval(input), credential theft, system compromise |
| HIGH | Serious risk, immediate attention required | Privilege escalation, sensitive access, impersonation |
| MEDIUM | Security concerns requiring review | Undeclared network, suspicious patterns |
| LOW | Minor issues, informational | Documentation problems, style issues |
Scan Modes
Fast (150ms): Static only, no API cost, for CI/CD
Comprehensive (2.2s): Static + LLM, API cost, for detailed analysis
LLM-Only (~2s): Semantic analysis, API cost, for second opinion
Standards Alignment
- Cisco Integrated AI Security Framework (December 2025)
- MITRE ATLAS
- OWASP Top 10 (LLM and Agentic)
- NIST AI Risk Management Framework
Reference: arxiv.org/html/2512.12921v1
Best Practices
For Skill Authors
- No hardcoded secrets
- No eval/exec
- Validate all inputs
- Declare permissions in allowed-tools
- Accurate descriptions
- No obfuscation
- Test before publishing
Response Guidelines
- CRITICAL: Do not deploy, fix immediately
- HIGH: Address before release
- MEDIUM: Review and plan fixes
- LOW: Address in future releases
Technical References
- Rule definitions:
skill_scanner/data/rules/signatures.yaml - YARA rules:
skill_scanner/data/yara_rules/ - Threat mappings:
skill_scanner/threats/threats.py