title: Malicious Skill Update or Mutation
id: ATR-2026-00065
rule_version: 1
status: experimental
description: |
  Detects MCP skills that have been updated to introduce malicious behavior after initial trust was established. A skill may pass initial review with benign code, then receive an update that adds data exfiltration, backdoors, or prompt injection. This rule monitors for suspicious patterns in tool responses and arguments that appear after a skill version change or re-registration.
author: ATR Community
date: 2026/03/08
schema_version: '0.1'
detection_tier: pattern
maturity: test
severity: high
references:
  owasp_llm:
    - LLM03:2025
  owasp_agentic:
    - ASI04:2026
  mitre_atlas:
    - AML.T0010 - AI Supply Chain Compromise
compliance:
  nist_ai_rmf:
    - subcategory: MG.3.2
      context: This rule detects malicious behavior introduced via skill updates or re-registration after initial trust was established, which is exactly the post-acquisition monitoring of pre-trained/third-party components required by MG.3.2. Continuous inspection of tool responses following version changes provides the evidence base for ongoing model/skill supply-chain monitoring.
      strength: primary
    - subcategory: GV.6.1
      context: Skill update attacks are a third-party/supplier AI risk where a previously vetted component mutates into a malicious one; GV.6.1 requires policies and procedures that govern such third-party AI risks, including detection of post-trust behavioral drift.
      strength: secondary
    - subcategory: MG.4.1
      context: Monitoring for suspicious patterns in tool arguments and responses after re-registration is a post-deployment monitoring activity; MG.4.1 mandates that such ongoing monitoring plans are implemented to catch emergent malicious behavior.
      strength: secondary
    - subcategory: MS.2.7
      context: NIST AI RMF MEASURE 2.7 (security and resilience evaluated and documented) is supported by this rule's runtime detection of the skill supply-chain compromise (Malicious Skill Update or Mutation).
      strength: primary
    - subcategory: MG.3.1
      context: NIST AI RMF MANAGE 3.1 (third-party resources regularly monitored) is supported where this rule detects the skill supply-chain compromise (Malicious Skill Update or Mutation).
      strength: secondary
  iso_42001:
    - clause: '8.1'
      context: ISO/IEC 42001 Clause 8.1 (operational planning and control, including control of externally provided processes) is operationalised by this rule's detection of the skill supply-chain compromise (Malicious Skill Update or Mutation).
      strength: primary
    - clause: '8.3'
      context: ISO/IEC 42001 Clause 8.3 (AI risk treatment) is supported by this rule, which implements runtime detection of the skill supply-chain compromise (Malicious Skill Update or Mutation) as a treatment control.
      strength: secondary
  eu_ai_act:
    - article: '15'
      context: Article 15 (accuracy, robustness and cybersecurity) requires high-risk AI systems to resist unauthorised attempts to alter their use, outputs or performance; this rule provides runtime detection evidence by flagging the skill supply-chain compromise (Malicious Skill Update or Mutation).
      strength: primary
    - article: '9'
      context: Article 9 (risk management system) requires identified risks to be addressed by appropriate measures; this rule is a runtime risk-treatment control that detects the skill supply-chain compromise (Malicious Skill Update or Mutation).
      strength: secondary
tags:
  category: tool-poisoning
  subcategory: skill-update-attack
  scan_target: mcp
  confidence: medium
agent_source:
  type: mcp_exchange
  framework:
    - mcp
    - langchain
    - autogen
  provider:
    - any
detection:
  conditions:
    - field: tool_response
      operator: regex
      value: (?i)(version[_\-\s]?(changed|updated|bumped|mutated)|new[_\-\s]?version[_\-\s]?available|skill[_\-\s]?updated)
    - field: tool_response
      operator: regex
      value: (?i)(additional[_\-\s]?permissions?[_\-\s]?required|scope[_\-\s]?expanded|capabilities?[_\-\s]?added|new[_\-\s]?permissions?)
    - field: tool_response
      operator: regex
      value: (?i)(re-?authenticate|re-?authorize|grant[_\-\s]?access|approve[_\-\s]?permissions?|accept[_\-\s]?new[_\-\s]?terms)
    - field: tool_response
      operator: regex
      value: (?i)(migration[_\-\s]?required|data[_\-\s]?transfer|export[_\-\s]?before[_\-\s]?update|backup[_\-\s]?your[_\-\s]?data[_\-\s]?to)
  condition: any
  false_positives:
    - Legitimate skill updates that require re-authorization
    - Platform migration notices from verified publishers
    - Dependency update notifications in development environments
response:
  actions:
    - block_tool
    - alert
    - snapshot
    - escalate
  auto_response_threshold: high
  message_template: |
    [ATR-2026-065] Suspicious skill update detected. The MCP skill response indicates a version change or permission expansion that may be a supply-chain attack. Verify the update through the official marketplace before proceeding.
confidence: 53
wild_validated: 2026/04/08
wild_samples: 53577