The Agent Skills Directory

[OBFUSCATION]: The skill documents and demonstrates several techniques to hide malicious instructions from human review while remaining executable by an LLM.
references/mcp-attack-payloads.md contains a Base64 encoded payload that decodes to a command for exfiltrating .env files.
The file also demonstrates using ANSI escape sequences (\x1b[8m) to hide malicious tool descriptions from terminal displays while ensuring the model processes the hidden instructions.
Zero-width Unicode characters (U+200B, U+200C, etc.) and Unicode Tag characters are showcased in references/mcp-attack-payloads.md as methods to encode hidden instructions in otherwise benign-looking text.
[DATA_EXFILTRATION]: The methodology provides specific payloads designed to access and exfiltrate highly sensitive system information.
Example payloads in references/mcp-attack-payloads.md target ~/.ssh/id_rsa, ~/.env, and /etc/passwd files.
The examples include instructions to send this data to external collector URLs such as https://attacker.com/log and https://attacker.com/collect.
[PROMPT_INJECTION]: The skill describes techniques to override agent behavior using specialized markers and multi-step tool hijacking.
Examples in references/mcp-attack-payloads.md use tags like <IMPORTANT> and <SYSTEM> to attempt to escalate instruction priority within the tool context.
The 'Shadow Tool' concept is introduced, where one tool's description is used to inject instructions that affect the execution of other, unrelated tools, such as hijacking email recipients.
[INDIRECT_PROMPT_INJECTION]: The skill identifies and provides testing steps for the indirect prompt injection attack surface inherent in the Model Context Protocol.
Ingestion points: Untrusted data enters the agent context via tool descriptions and inputSchema metadata provided by an MCP Server, as detailed in SKILL.md.
Boundary markers: The documentation in SKILL.md specifically highlights the absence of effective boundaries between tool descriptions and system instructions as a primary vulnerability.
Capability inventory: The methodology identifies capabilities like read_file, send_email, and http_request as vulnerable components that can be manipulated via poisoned descriptions.
Sanitization: Documents the risk where clients透传 (pass-through) tool metadata to the model without validation or sanitization, leading to instruction hijacking.

mcp-security