title: Skill Rug Pull Setup Pattern
id: ATR-2026-00126
rule_version: 1
status: experimental
description: |
  Detects SKILL.md files architecturally designed for rug pulls: initially safe content that can be remotely updated to become malicious. Patterns include dynamic code loading from URLs (eval(fetch(...))), base64-decoded execution, post-install hooks with remote payloads, and obfuscated function constructors. True rug pull detection requires comparing hashes over time (TC verdict cache), but this rule catches the setup patterns that make rug pulls possible. Inspired by Claude Code leak analysis and npm supply chain attacks.
author: ATR Community
date: 2026/04/05
schema_version: '0.1'
detection_tier: pattern
maturity: test
severity: high
references:
  mitre_atlas:
    - AML.T0010 - AI Supply Chain Compromise
    - AML.T0109 - AI Supply Chain Rug Pull
    - AML.T0010.005 - AI Supply Chain Compromise of AI Agent Tool
  owasp_llm:
    - LLM05:2025
  owasp_agentic:
    - ASI04:2026
  owasp_ast:
    - AST06:2026 - Rug Pull / Supply Chain
  research:
    - 'Claude Code leak: SKILL.md update-then-attack pattern (2026-03)'
    - 'npm event-stream incident (2018): rug pull archetype'
metadata_provenance:
  mitre_atlas: auto-generated
compliance:
  nist_ai_rmf:
    - subcategory: GV.6.1
      context: Skill rug pull setup patterns embed mechanisms for third-party suppliers to swap initially-benign skill content with malicious payloads after trust is established; GV.6.1 requires policies and procedures that address these third-party/supplier AI supply chain risks at ingestion time.
      strength: primary
    - subcategory: MG.3.1
      context: Detecting dynamic remote code loading, base64-decoded execution, and post-install hooks in SKILL.md files produces evidence for managing third-party AI risks under MG.3.1, flagging supplier-provided components that retain the ability to mutate into malicious behavior post-deployment.
      strength: secondary
    - subcategory: MG.3.2
      context: Rug pull setup architecture undermines integrity assurances for externally-sourced components used in development; MG.3.2 requires monitoring of pre-trained or third-party model and skill artifacts so that deferred-payload patterns are caught before they activate.
      strength: secondary
    - subcategory: MS.2.7
      context: NIST AI RMF MEASURE 2.7 (security and resilience evaluated and documented) is supported by this rule's runtime detection of the skill supply-chain compromise (Skill Rug Pull Setup Pattern).
      strength: primary
  iso_42001:
    - clause: '8.1'
      context: ISO/IEC 42001 Clause 8.1 (operational planning and control, including control of externally provided processes) is operationalised by this rule's detection of the skill supply-chain compromise (Skill Rug Pull Setup Pattern).
      strength: primary
    - clause: '8.3'
      context: ISO/IEC 42001 Clause 8.3 (AI risk treatment) is supported by this rule, which implements runtime detection of the skill supply-chain compromise (Skill Rug Pull Setup Pattern) as a treatment control.
      strength: secondary
  eu_ai_act:
    - article: '15'
      context: Article 15 (accuracy, robustness and cybersecurity) requires high-risk AI systems to resist unauthorised attempts to alter their use, outputs or performance; this rule provides runtime detection evidence by flagging the skill supply-chain compromise (Skill Rug Pull Setup Pattern).
      strength: primary
    - article: '9'
      context: Article 9 (risk management system) requires identified risks to be addressed by appropriate measures; this rule is a runtime risk-treatment control that detects the skill supply-chain compromise (Skill Rug Pull Setup Pattern).
      strength: secondary
tags:
  category: skill-compromise
  subcategory: rug-pull
  scan_target: skill
  confidence: medium
agent_source:
  type: mcp_exchange
  framework:
    - any
  provider:
    - any
detection:
  condition: any
  conditions:
    - field: content
      operator: regex
      value: (?i)(eval|Function|new\s+Function)\s*\(\s*(fetch|axios|got|request|http\.get|https\.get|require\(['"]https?)
      description: Dynamic code execution from remote URL
    - field: content
      operator: regex
      value: (?i)(eval|exec|spawn|Function)\s*\(\s*(atob|Buffer\.from|base64[._-]?decode)\s*\(
      description: Base64 decode then execute
    - field: content
      operator: regex
      value: (?i)(post[_-]?install|after[_-]?install|setup|init)\s*["':].{0,50}(curl|wget|fetch|http|https|ftp)\s
      description: Post-install hook fetching remote content
    - field: content
      operator: regex
      value: (?i)(fetch|load|download|pull|sync|update)\s+(config|configuration|settings|rules|behavior|instructions|commands)\s+(from|via|using|at)\s+(https?://|http://|ftp://)
      description: Remote configuration loading that could change behavior
    - field: content
      operator: regex
      value: \b(\w+)\s*\[\s*['"]constructor['"]\s*\]\s*\(|Function\.prototype\.constructor
      description: Obfuscated Function constructor access
  false_positives:
    - Documentation or tutorials that explain supply chain attack techniques by showing example payloads like 'eval(fetch(...))' in code blocks for educational purposes, such as security training materials or blog posts about npm security.
confidence: 78
wild_validated: 2026/04/08
wild_samples: 53577
wild_fp_rate: 0.0224
response:
  actions:
    - alert
    - block_input