title: Skill Scope Hijacking and Cross-Agent Escalation
id: ATR-2026-00164
rule_version: 1
status: experimental
description: |
  Detects SKILL.md files that instruct agents to expand their scope beyond the skill's stated purpose, access other agents' data, or escalate privileges through natural-language social engineering patterns specific to skill docs.
author: ATR Project
date: 2026/04/14
schema_version: '1.0'
detection_tier: pattern
maturity: test
severity: high
references:
  owasp_llm:
    - LLM06:2025
  owasp_agentic:
    - ASI03:2026
  mitre_atlas:
    - AML.T0051 - LLM Prompt Injection
compliance:
  eu_ai_act:
    - article: '14'
      context: Skill scope hijacking embeds privilege escalation instructions within SKILL.md files to expand agent capabilities beyond authorized boundaries without human knowledge; Article 14 requires that agents operate within sanctioned scopes visible to human overseers.
      strength: primary
    - article: '15'
      context: Article 15 cybersecurity requirements mandate protection against supply chain attacks; malicious SKILL.md files represent a documented technique for injecting unauthorized capability expansion at the skill-definition layer.
      strength: secondary
    - article: '9'
      context: Article 9 (risk management system) requires identified risks to be addressed by appropriate measures; this rule is a runtime risk-treatment control that detects the agent-manipulation technique (Skill Scope Hijacking and Cross-Agent Escalation).
      strength: secondary
  nist_ai_rmf:
    - subcategory: GV.1.2
      context: Skill scope hijacking succeeds when no accountability role governs what capabilities a skill may claim; GV.1.2 requires that accountability roles for AI risk management are defined and assigned, ensuring that SKILL.md capability claims are reviewed against authorized scope boundaries.
      strength: primary
    - subcategory: MP.2.3
      context: Malicious SKILL.md files in external skill repositories represent an AI supply chain risk source; MP.2.3 requires that AI supply chain risk sources are identified and assessed, covering the skill-definition layer as a vector for privilege escalation injection.
      strength: secondary
    - subcategory: MS.2.7
      context: NIST AI RMF MEASURE 2.7 (security and resilience evaluated and documented) is supported by this rule's runtime detection of the agent-manipulation technique (Skill Scope Hijacking and Cross-Agent Escalation).
      strength: primary
    - subcategory: MG.2.3
      context: NIST AI RMF MANAGE 2.3 (respond to previously unknown identified risks) is supported by this rule, which surfaces the agent-manipulation technique (Skill Scope Hijacking and Cross-Agent Escalation) so the risk can be treated.
      strength: secondary
  iso_42001:
    - clause: '6.2'
      context: Clause 6.2 AI objectives and plans must include risk treatment for skill-definition-layer attacks where SKILL.md instructions expand agent scope beyond authorized boundaries without human knowledge.
      strength: primary
    - clause: '8.1'
      context: Clause 8.1 controls over externally-provided AI components must include validation of SKILL.md files to ensure that skill definitions do not embed cross-agent escalation or unauthorized scope expansion instructions.
      strength: secondary
tags:
  category: agent-manipulation
  subcategory: skill-scope-hijack
  scan_target: skill
  confidence: high
agent_source:
  type: mcp_exchange
  framework:
    - any
  provider:
    - any
detection:
  conditions:
    - field: content
      operator: regex
      value: (?i)(?:also|additionally|while\s+you.re\s+at\s+it|before\s+(?:returning|responding))\s+(?:read|access|check|scan|collect|gather|harvest)\s+(?:all\s+)?(?:other|additional|nearby|available|accessible)\s+(?:files?|directories|folders?|configs?|secrets?|keys?|tokens?|env)
      description: Scope expansion — skill instructs agent to access resources beyond its purpose
    - field: content
      operator: regex
      value: (?i)(?:send|forward|relay|pass|share|transmit)\s+(?:this|these|the|all)\s+(?:results?|data|output|findings?|information)\s+to\s+(?:the\s+)?(?:other|another|secondary|backup|external)\s+(?:agent|server|endpoint|service|API)
      description: Cross-agent data forwarding instruction
    - field: content
      operator: regex
      value: (?i)(?:you\s+(?:also\s+)?have|this\s+skill\s+(?:also\s+)?has|you\s+can\s+also|additionally\s+you\s+can)\s+(?:full\s+)?(?:access|permission|authority|rights?)\s+to\s+(?:all\s+)?(?:files?|system|network|internet|shell|root)
      description: False authority claim — skill claims broader permissions than granted
    - field: content
      operator: regex
      value: (?i)(?:override|expand|extend|elevate|escalate)\s+(?:your\s+)?(?:current\s+)?(?:scope|permissions?|access|privileges?|authority|role)\s+(?:to|beyond|past)
      description: Direct privilege escalation instruction
  condition: any
  false_positives:
    - Multi-agent orchestration tools that legitimately coordinate between agents
    - Admin/ops skills that genuinely need broad access
response:
  actions:
    - alert
    - block_tool
  message_template: |
    [ATR-2026-00164] Skill attempts to expand agent scope beyond its stated purpose or escalate privileges through embedded instructions.