title: Weaponized Skill — Agent as Attack Tool
id: ATR-2026-00122
rule_version: 1
status: experimental
description: |
  Detects skills that weaponize AI agents for offensive operations. Cato Networks demonstrated deploying MedusaLocker ransomware via a modified Claude skill (Dec 2025, disclosed to Anthropic Oct 30, 2025). The "consent gap" allows approved skills to download/execute code, read env vars, and write files without further prompts. arXiv 2601.17548 documents attack tooling embedded in skills with 41-84% success rates. Real examples include SQLMap workflows, Metasploit payloads, and credential brute-force tools found on skills.sh and ClawHub.
author: ATR Community
date: 2026/03/29
schema_version: '0.1'
detection_tier: pattern
maturity: test
severity: high
references:
  mitre_atlas:
    - AML.T0010 - AI Supply Chain Compromise
  owasp_llm:
    - LLM06:2025
  owasp_agentic:
    - ASI05:2026
    - ASI01:2026
  owasp_ast:
    - AST01:2026 - Malicious Skills
    - AST03:2026 - Over-Privileged Skills
  research:
    - 'Cato Networks: MedusaLocker via Claude skill (Dec 2025)'
    - 'arXiv 2601.17548: 41-84% attack success'
    - 'Axios: Anthropic Claude skills ransomware disclosure'
metadata_provenance:
  mitre_atlas: auto-generated
compliance:
  nist_ai_rmf:
    - subcategory: GV.6.1
      context: Weaponized skills are third-party/supplier AI components that embed offensive tooling (SQLMap, Metasploit, ransomware payloads) into agent workflows; GV.6.1 requires policies and procedures to address third-party AI supply chain risks where approved skills can execute malicious code without further consent.
      strength: primary
    - subcategory: MG.3.2
      context: Detecting offensive tooling embedded in skills directly evidences the need to monitor pre-trained models and skill artifacts used for development; MG.3.2 mandates ongoing monitoring of these third-party components for malicious modifications like the MedusaLocker-laden Claude skill.
      strength: secondary
    - subcategory: MG.2.3
      context: Detection of weaponized skills must trigger mechanisms to disengage or deactivate the AI system before the consent gap is exploited to download/execute code or exfiltrate credentials; MG.2.3 requires these supersede/deactivate controls be in place.
      strength: secondary
    - subcategory: MS.2.7
      context: NIST AI RMF MEASURE 2.7 (security and resilience evaluated and documented) is supported by this rule's runtime detection of the skill supply-chain compromise (Weaponized Skill — Agent as Attack Tool).
      strength: primary
    - subcategory: MG.3.1
      context: NIST AI RMF MANAGE 3.1 (third-party resources regularly monitored) is supported where this rule detects the skill supply-chain compromise (Weaponized Skill — Agent as Attack Tool).
      strength: secondary
  iso_42001:
    - clause: '8.1'
      context: ISO/IEC 42001 Clause 8.1 (operational planning and control, including control of externally provided processes) is operationalised by this rule's detection of the skill supply-chain compromise (Weaponized Skill — Agent as Attack Tool).
      strength: primary
    - clause: '8.3'
      context: ISO/IEC 42001 Clause 8.3 (AI risk treatment) is supported by this rule, which implements runtime detection of the skill supply-chain compromise (Weaponized Skill — Agent as Attack Tool) as a treatment control.
      strength: secondary
  eu_ai_act:
    - article: '15'
      context: Article 15 (accuracy, robustness and cybersecurity) requires high-risk AI systems to resist unauthorised attempts to alter their use, outputs or performance; this rule provides runtime detection evidence by flagging the skill supply-chain compromise (Weaponized Skill — Agent as Attack Tool).
      strength: primary
    - article: '9'
      context: Article 9 (risk management system) requires identified risks to be addressed by appropriate measures; this rule is a runtime risk-treatment control that detects the skill supply-chain compromise (Weaponized Skill — Agent as Attack Tool).
      strength: secondary
tags:
  category: skill-compromise
  subcategory: weaponized-skill
  scan_target: skill
  confidence: medium
agent_source:
  type: mcp_exchange
  framework:
    - skill_md
  provider:
    - any
detection:
  conditions:
    - field: content
      operator: regex
      value: (?i)sqlmap\s+(-[uo]\s|--url\s|--dbs|--dump|--os-shell|--batch)
      description: SQLMap attack execution (real skills.sh finding)
    - field: content
      operator: regex
      value: (?i)(msfconsole|msfvenom|use\s+exploit/|set\s+payload/|set\s+LHOST|set\s+RHOST)
      description: Metasploit exploitation framework
    - field: content
      operator: regex
      value: (?i)(hydra\s+-[lLpPCM]|john\s+--wordlist|hashcat\s+-[am]\s|medusa\s+-[hHuUpP])
      description: Credential brute-force tooling
    - field: content
      operator: regex
      value: (?i)(nmap\s+.*--script[= ](exploit|vuln|brute)|masscan\s+-p|nikto\s+-h)
      description: Network exploitation scanning
    - field: content
      operator: regex
      value: (?i)(encrypt\s+(all|every|the)\s+(file|document|data).{0,200}(ransom|payment|bitcoin|wallet|decrypt\s+fee|pay\s+to))|(ransom\s+note.{0,100}(bitcoin|wallet|payment|decrypt))
      description: 'Ransomware: encryption + payment demand combo (Cato MedusaLocker)'
  condition: any
  false_positives:
    - Authorized penetration testing skills with explicit scope controls
    - CTF competition skills in sandboxed environments
    - Defensive security skills that reference attack tools conceptually
    - Security audit documentation that includes exact command examples from penetration testing reports for remediation guidance
    - Academic cybersecurity coursework or textbooks quoting tool syntax in instructional contexts
response:
  actions:
    - alert
    - alert
  message_template: |
    [ATR-2026-122] Weaponized skill detected. This skill contains executable attack tooling that could turn the AI agent into an offensive weapon. See: Cato Networks MedusaLocker PoC (Dec 2025).
confidence: 70
wild_validated: 2026/04/08
wild_samples: 53577
wild_fp_rate: 0.0504