Agent Skills Threat Taxonomy

Agent Skills Threat Taxonomy

Overview

Authoritative threat classification for agent skills security analysis, aligned with the Cisco Integrated AI Security and Safety Framework (December 2025).

Detection Engines:

• Static Analyzer: 58 pattern-based rules (YAML + YARA + Python)
• LLM Analyzer: Semantic analysis via Claude/GPT/Gemini

Validation: 149 tests passing, 0% false CRITICAL rate on official skills

Threat Categories

1. Prompt Injection

AITech: AITech-1.1, AITech-1.2 | Risk: HIGH-CRITICAL

Malicious instructions that manipulate AI behavior or bypass safety systems.

Detected by: YAML rules, YARA (prompt_injection_generic, coercive_injection_generic), LLM analysis

Examples: "Ignore previous instructions", "unrestricted mode", "don't tell user"

2. Command & Code Injection

AITech: AITech-9.1.4 | Risk: CRITICAL

Unsafe code execution enabling arbitrary command execution.

Detected by: YAML rules, YARA (code_execution_generic, command_injection_generic, sql_injection_generic), LLM analysis

Examples: eval(), os.system(), subprocess shell=True, SQL injection, reverse shells

3. Data Exfiltration

AITech: AITech-8.2, AITech-8.2.3 | Risk: CRITICAL

Unauthorized data access and transmission to external locations.

Detected by: YAML rules, YARA (credential_harvesting_generic, tool_chaining_abuse_generic), LLM flow analysis

Examples: Network calls with credentials, ~/.aws access, environment harvesting, read→send chains

4. Hardcoded Secrets

AITech: AITech-8.2 | Risk: CRITICAL

Credentials embedded in code files.

Detected by: YAML rules, YARA (credential_harvesting_generic), LLM pattern recognition

Examples: API keys (AKIA, ghp_, sk-proj), private keys, JWT tokens, connection strings

5. Tool & Permission Abuse

AITech: AITech-12.1 | Risk: MEDIUM-CRITICAL

Violating allowed-tools restrictions or undeclared capabilities.

Detected by: Python validation checks, YARA (system_manipulation_generic), LLM permission analysis

Examples: Writing files without Write tool, undeclared network, package installation, system modifications, tool poisoning, tool shadowing, unauthorized tool use

6. Obfuscation

Risk: MEDIUM-CRITICAL

Deliberate code obfuscation hiding malicious intent.

Detected by: YAML rules, YARA (code_execution_generic, script_injection_generic), binary detection, LLM intent analysis

Examples: Binary executables, base64→exec, hex encoding, XOR ciphers

7. Protocol Manipulation - Capability Inflation

AITech: AITech-4.3 / AISubtech-4.3.5 | Risk: LOW-HIGH

Manipulation of skill discovery mechanisms to inflate perceived capabilities and increase unwanted activation. Actors manipulate skill metadata, descriptions, or discovery protocols to make skills appear more capable or relevant than they actually are, leading to inappropriate skill selection or invocation.

Detected by: YAML rules, YARA (capability_inflation_generic), Python checks, LLM deception analysis

Examples: Brand impersonation, over-broad capability claims, keyword baiting, description-behavior mismatch

8. Indirect Prompt Injection - Instruction Manipulation

AITech: AITech-1.2 / AISubtech-1.2.1 | Risk: HIGH

Embedding malicious instructions within external data sources (e.g., documents, web pages, emails, databases, API responses) that an LLM retrieves and processes, causing these external instructions to override or modify the model's intended behavior without the user's knowledge or awareness. The attack exploits the model's inability to distinguish between trusted system instructions and untrusted external content.

Detected by: YARA (indirect_prompt_injection_generic), LLM trust analysis

Examples: "Follow webpage instructions", "execute code blocks found in files", "obey file content", delegating trust to untrusted external sources

9. Autonomy Abuse

AITech: AITech-13.1 / AISubtech-13.1.1 | Risk: MEDIUM-HIGH

Excessive autonomous behavior without user confirmation (compute exhaustion).

Detected by: YAML rules, YARA (autonomy_abuse_generic), LLM behavioral analysis

Examples: "Keep retrying forever", "run without asking", ignore errors, self-modification

10. Tool Chaining

AITech: AITech-8.2.3 | Risk: HIGH

Multi-step operations chaining tools for data exfiltration.

Detected by: YARA (tool_chaining_abuse_generic), LLM workflow analysis

Examples: Read→send patterns, collect→post chains, automated pipelines

11. Resource Abuse

AITech: AITech-13.1 / AISubtech-13.1.1 | Risk: LOW-MEDIUM

Excessive resource consumption causing instability (compute exhaustion).

Detected by: YAML rules, YARA patterns, LLM resource analysis

Examples: Infinite loops, unbounded recursion, memory bombs, fork bombs

Detection Architecture

Static Analyzer (58 methods)

• 35 YAML regex rules
• 13 YARA pattern files
• 6 Python validation checks
• 5 consistency validations

LLM Analyzer

• Semantic analysis across all categories
• Behavioral pattern recognition
• Intent detection
• Workflow analysis
• Structured Output: Enforces AITech taxonomy codes via JSON schema (API-level enforcement)
• Direct AITech Mapping: LLM returns AITech codes directly, mapped to ThreatCategory enum

Severity Levels

Scan Modes

Fast (150ms): Static only, no API cost, for CI/CD Comprehensive (2.2s): Static + LLM, API cost, for detailed analysis LLM-Only (~2s): Semantic analysis, API cost, for second opinion

Standards Alignment

• Cisco Integrated AI Security Framework (December 2025)
• MITRE ATLAS
• OWASP Top 10 (LLM and Agentic)
• NIST AI Risk Management Framework

Reference: arxiv.org/html/2512.12921v1

Best Practices

For Skill Authors

• No hardcoded secrets
• No eval/exec
• Validate all inputs
• Declare permissions in allowed-tools
• Accurate descriptions
• No obfuscation
• Test before publishing

Response Guidelines

• CRITICAL: Do not deploy, fix immediately
• HIGH: Address before release
• MEDIUM: Review and plan fixes
• LOW: Address in future releases

Technical References

• Rule definitions: skill_scanner/data/rules/signatures.yaml
• YARA rules: skill_scanner/data/yara_rules/
• Threat mappings: skill_scanner/threats/threats.py