title: Skill Description-Behavior Mismatch
id: ATR-2026-00061
rule_version: 1
status: experimental
description: |
  Detects MCP skills whose runtime behavior diverges from their declared description. A skill described as "read-only file browser" that issues write or delete operations, or a "weather lookup" tool that accesses filesystem or network resources beyond its stated scope. This is a supply-chain indicator: a compromised or trojaned skill may retain its benign description while performing malicious actions.
author: ATR Community
date: 2026/03/08
schema_version: '0.1'
detection_tier: pattern
maturity: experimental
severity: medium
references:
  owasp_llm:
    - LLM03:2025
    - LLM05:2025
  owasp_agentic:
    - ASI04:2026
  mitre_atlas:
    - AML.T0010 - AI Supply Chain Compromise
    - AML.T0056 - Extract LLM System Prompt
compliance:
  nist_ai_rmf:
    - subcategory: MG.3.2
      context: Skill description-behavior mismatch is a direct supply-chain compromise indicator where a third-party MCP skill's runtime actions diverge from its declared manifest; MG.3.2 requires monitoring of pre-trained models and third-party components used in development for exactly this kind of trojaned behavior.
      strength: primary
    - subcategory: GV.6.1
      context: Detecting skills that retain benign descriptions while performing malicious operations evidences enforcement of third-party/supplier AI risk policies; GV.6.1 requires policies that govern integration of external skills and surface mismatches between declared and actual behavior.
      strength: secondary
    - subcategory: MS.2.7
      context: Runtime divergence between declared scope (e.g., read-only) and observed actions (writes, network access) is a security/resilience signal; MS.2.7 requires continuous evaluation of AI system security posture, which this detection feeds with concrete supply-chain integrity findings.
      strength: secondary
    - subcategory: MG.3.1
      context: NIST AI RMF MANAGE 3.1 (third-party resources regularly monitored) is supported where this rule detects the skill supply-chain compromise (Skill Description-Behavior Mismatch).
      strength: secondary
  iso_42001:
    - clause: '8.1'
      context: ISO/IEC 42001 Clause 8.1 (operational planning and control, including control of externally provided processes) is operationalised by this rule's detection of the skill supply-chain compromise (Skill Description-Behavior Mismatch).
      strength: primary
    - clause: '8.3'
      context: ISO/IEC 42001 Clause 8.3 (AI risk treatment) is supported by this rule, which implements runtime detection of the skill supply-chain compromise (Skill Description-Behavior Mismatch) as a treatment control.
      strength: secondary
  eu_ai_act:
    - article: '15'
      context: Article 15 (accuracy, robustness and cybersecurity) requires high-risk AI systems to resist unauthorised attempts to alter their use, outputs or performance; this rule provides runtime detection evidence by flagging the skill supply-chain compromise (Skill Description-Behavior Mismatch).
      strength: primary
    - article: '9'
      context: Article 9 (risk management system) requires identified risks to be addressed by appropriate measures; this rule is a runtime risk-treatment control that detects the skill supply-chain compromise (Skill Description-Behavior Mismatch).
      strength: secondary
tags:
  category: tool-poisoning
  subcategory: description-mismatch
  scan_target: mcp
  confidence: medium
agent_source:
  type: tool_call
  framework:
    - mcp
    - langchain
    - autogen
  provider:
    - any
detection:
  conditions:
    - field: tool_args
      operator: regex
      value: (?i)(rm\s+-rf|unlink|deleteFile|removeDir|fs\.write|writeFile|appendFile|truncate)
    - field: tool_args
      operator: regex
      value: (?i)(\bcurl\s+[^\n]{0,60}?(https?|ftp)://|\bwget\s+[^\n]{0,60}?(https?|ftp)://|\bcurl\s+-[A-Za-z]|\bwget\s+-[A-Za-z]|\bfetch\s*\(|\bnode-fetch\b|http\.request|axios\.|net\.connect|socket\.connect)
      description: |-
        Network egress primitives, anchored to INVOCATION syntax rather than to the bare word. The previous pattern listed `fetch` as a naked alternative, so the English sentence "Fetch the current weather forecast for a given location" false-positived a critical-path rule whose response actions are block_tool + escalate. curl/wget now need a URL or a flag, fetch needs a call, and the library entry points (http.request, axios., net.connect) are unchanged.
        This condition is a pure NARROWING of the base pattern: nothing was added while tightening it. An earlier revision of this fix also introduced `urllib.request` and `requests.(get|post|put|patch|delete)(` — new coverage the base never had — and those two alternatives promptly matched ordinary benign Python in the gate corpus (`benign-code/std-18`: `requests.get(url, timeout=10)`, `benign-code/cfg-04`: a localhost health check). Buying new egress coverage while paying for it in benign source code is exactly the trade a precision fix must not make, so they are gone. Cost of removing them, measured: one attack sample (promptfoo/4) out of 1,657.
    - field: tool_args
      operator: regex
      value: (?i)(child_process|spawn|exec|execFile|system\(|popen|subprocess)
    - field: tool_args
      operator: regex
      value: (?i)(process\.env|os\.environ|getenv|\$\{?[A-Z_]+\}?|secrets?\.|credentials?)
    - field: tool_response
      operator: regex
      value: (?i)(password|api[_-]?key|secret[_-]?key|access[_-]?token|private[_-]?key|bearer\s+[a-zA-Z0-9])
  condition: any
  false_positives:
    - Development tools that legitimately perform filesystem writes as part of their function
    - CI/CD tools that execute build commands
    - Configuration management tools that read environment variables
response:
  actions:
    - alert
    - snapshot
    - escalate
  actions_rationale: 'response-action eligibility (docs/RESPONSE-ACTION-ELIGIBILITY.md): benign FP 2814/5352 = 52.58% exceeds the 2% automatic-demotion line; ceiling = observe. Removed block_tool(interrupt). Detection unchanged — recall cost is zero.'
  auto_response_threshold: high
  message_template: |
    [ATR-2026-061] Skill behavior does not match declared description. Tool arguments or response contain operations outside the tool's stated capability scope. Review tool source and publisher before re-enabling.
confidence: 57
wild_validated: 2026/08/05
wild_samples: 5352
wild_fp_rate: 52.58