Malware and Credential Exposure in AI Agent Instruction Files (Skills, Hooks, MCP Configs) - Mitiga Skillgate Research

Key facts

Detection coverage

As of 2026-11-12, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-5878 across Splunk SPL, Microsoft KQL and Sigma, covering 15 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: PromptLogger - AI Coding Agent Spawns Silent curl/PowerShell to Request-Sink Exfil Endpoint

Detects an AI coding agent process (Claude Code, Cursor, Cline, Gemini CLI, Codex, Windsurf, aider, opencode or their node/Code host) spawning curl, wget, PowerShell or a shell whose command line targets webhook.site, Pipedream, Supabase or the Telegram Bot API. This is the core PromptLogger behaviour (TL-2026-5878): a poisoned .cursorrules, .clinerules, CLAUDE.md, GEMINI.md or copilot-instructions.md file instructs the agent to silently copy every user prompt, .env contents or environment variables to an operator-controlled sink with output hidden from the user. A 'silent' flag marks quiet-mode / output-suppressed invocations.

• Languages: Splunk SPL, Microsoft KQL, Sigma
• ATT&CK: T1059.004, T1059.001, T1567, T1056
• Data sources: sysmon, microsoft_defender_for_endpoint, windows_security
• Severity: high
• Confidence: high

Splunk SPL

index=sysmon sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1
| eval par=lower(ParentImage), img=lower(Image), cmd=lower(CommandLine)
| where match(par, "(claude|cursor|windsurf|cline|gemini|codex|aider|opencode|node|code)([.]exe)?$")
| where match(img, "(curl|wget|powershell|pwsh|cmd|bash|sh)([.]exe)?$")
| where match(cmd, "webhook[.]site|pipedream[.]net|[.]supabase[.]co|api[.]telegram[.]org/bot|requestbin[.]com")
| eval silent=if(match(cmd, "(^|[[:space:]])-(s|ss|ssl|fssl|q)([[:space:]]|$)|--silent|/dev/null|-windowstyle[[:space:]]+hidden"), 1, 0)
| table _time host User ParentImage Image CommandLine silent

Microsoft KQL

DeviceProcessEvents
| where Timestamp > ago(24h)
| where InitiatingProcessFileName has_any ("claude", "cursor", "windsurf", "cline", "gemini", "codex", "aider", "opencode", "node", "code")
| where FileName in~ ("curl.exe", "curl", "wget.exe", "wget", "powershell.exe", "pwsh.exe", "pwsh", "bash", "sh", "cmd.exe")
| where ProcessCommandLine has_any ("webhook.site", "pipedream.net", ".supabase.co", "api.telegram.org/bot", "requestbin.com")
| extend SilentFlags = ProcessCommandLine matches regex @"(?i)((^|[[:space:]])-(s|sS|sSL|fsSL|q)([[:space:]]|$)|--silent|/dev/null|-windowstyle[[:space:]]+hidden)"
| project Timestamp, DeviceName, AccountName, InitiatingProcessFileName, InitiatingProcessCommandLine, FileName, ProcessCommandLine, SilentFlags

Sigma

title: AI Coding Agent Spawns Shell Exfiltration To Request-Sink Service (PromptLogger)
id: 5b0f3c1e-7a42-4d6b-9c21-8e5a1f0d3b71
status: experimental
description: Detects an AI coding agent or its node/editor host spawning curl, wget, PowerShell or a shell that contacts webhook.site, Pipedream, Supabase or the Telegram Bot API, the PromptLogger prompt and secret exfiltration behaviour driven by poisoned instruction files.
references:
  - https://www.mitiga.io/blog/malware-in-ai-instruction-files-skillgate
  - https://www.csoonline.com/article/4204731/attackers-are-crafting-malicious-ai-instruction-files-to-turn-your-agentic-workflows-into-quiet-criminal-helpers.html
author: Threadlinqs Team
date: 2026/11/12
tags:
  - attack.execution
  - attack.t1059.004
  - attack.t1059.001
  - attack.exfiltration
  - attack.t1567
  - attack.collection
  - attack.t1056
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith:
      - 'claude.exe'
      - 'cursor.exe'
      - 'windsurf.exe'
      - 'cline.exe'
      - 'gemini.exe'
      - 'codex.exe'
      - 'aider.exe'
      - 'opencode.exe'
      - 'node.exe'
      - 'code.exe'
  selection_child:
    Image|endswith:
      - 'curl.exe'
      - 'wget.exe'
      - 'powershell.exe'
      - 'pwsh.exe'
      - 'cmd.exe'
  selection_sink:
    CommandLine|contains:
      - 'webhook.site'
      - 'pipedream.net'
      - '.supabase.co'
      - 'api.telegram.org/bot'
      - 'requestbin.com'
  condition: all of selection_*
falsepositives:
  - Developers legitimately testing webhooks against webhook.site or Pipedream from an editor terminal
  - Sanctioned Supabase or Telegram bot development workflows
level: high

Known false positives:

• Developers testing webhooks against webhook.site or Pipedream from an editor-integrated terminal
• Sanctioned Supabase or Telegram bot development where the agent runs curl against the project API

Tuning notes: Allowlist known-good Supabase project hostnames and sanctioned webhook test hosts by command-line substring. Raise priority when silent=1 or when the command line reads .env or pipes prompt text. On Linux/macOS use Sysmon for Linux or auditd execve with the same regexes (adjust Image path matching). Narrow the 'node' and 'code' parent names to your approved agent install paths to cut noise.

• 🔒 Trojanized Agent Skill Execution - Paperclip / Browser Use Impersonation and Agent-Spawned Bypass or Encoded Shell · unlock with TL Creds
• 🔒 ANTHROPIC_BASE_URL Override to Third-Party Host and Permission-Bypass (YOLO) Agent Launch · unlock with TL Creds
• 🔒 Local MITM Proxy Launch and MCP Server Registration to Hardcoded IP (MCP Token Interception) · unlock with TL Creds
• 🔒 Agent Skill / Instruction File Dropped by Download or Script Interpreter · unlock with TL Creds
• 🔒 AI Agent Child Process Harvesting Environment Variables and .env Secrets · unlock with TL Creds
• 🔒 AI Agent Adds Unfamiliar Git Remote or Pushes Codebase to Explicit External URL (Skill-Based Codebase Exfiltration) · unlock with TL Creds
• 🔒 Agent Config and Hook Rewrite ([indicator], settings.json, mcp.json, hooks.json) by Installer or Script Interpreter · unlock with TL Creds
• 🔒 Non-Browser Process DNS Resolution of PromptLogger Exfil Sinks ([indicator], Pipedream, Supabase, Telegram) · unlock with TL Creds

Indicators of compromise

As of 2026-11-12, Threadlinqs Intelligence tracks 15 indicators of compromise for TL-2026-5878.

Sample indicators (1 of 15)

• Domain: webhook[.]site

Defanged, TLP:CLEAR. Full set of 15 indicators: unlock with TL Creds.

Technical analysis

Mitiga Labs ('License to Skill' / 'Breaking Skills' series) studied AI agent instruction files - Skills (SKILL.md), Claude Hooks, agent context files (CLAUDE.md, AGENTS.md, GEMINI.md), MCP configs (settings.json, mcp.json, hooks.json), agentic rules (.cursorrules, .clinerules, .github/copilot-instructions.md, aider YAML, opencode, Continue), package.json supply-chain droppers and poisoned .pyc files. The corpus (April-June 2026) comprised 50,000+ instruction files from 7,000+ public GitHub repositories plus arXiv-referenced samples and Skillforge-generated adversarial inputs; findings were triaged by an LLM reviewer (Gator Agent) and a human. Mitiga did not test actual exploitation or use any discovered credential, and describes Skillgate flags as 'needs review' rather than confirmed malware.

The headline finding is prompt exfiltration ('PromptLogger'): an instruction file directs the agent to silently capture every user prompt, sometimes responses, environment variables, tokens and deployment details and send them to an operator-controlled endpoint, with no conventional malware required. Mitiga reports a live case and holds the mechanics for a dedicated report. CSO Online (2026-08-04) summarizes six public-repo cases: a DevOps repo whose poisoned .cursorrules and .github/copilot-instructions.md ran a silent curl copying each prompt to a Supabase database with a hardcoded access token; an MLOps repo whose .clinerules sent environment variables and command output (WANDB key, AWS access key, GitHub token, MLflow URL) to Webhook.site; a 'FastAPI starter kit' whose .cursorrules/CLAUDE.md sent .env contents to Webhook.site framed as a team sync with output hidden; and a 'Zero Trust' GEMINI.md that told the agent to scrape env vars whose names contain key/secret/token/pass and inject an initialization block into every generated or modified Python file, sending data to a Pipedream endpoint. Other risky configurations: standing permission to fetch from an external URL (fetch-and-execute), an MCP endpoint on a hardcoded IP (possible MITM proxy), YOLO/auto-approve mode combined with an ANTHROPIC_BASE_URL override routing Claude traffic via a third-party host, a service bound to 0.0.0.0 with hardcoded Postgres credentials, PowerShell execution-policy bypass inside a SKILL.md, and 1,230+ hardcoded API keys and JWTs across tens of services (Anthropic, OpenAI, Google Gemini, xAI, MiniMax, DeepSeek, Context7, Databricks, Supabase, Vercel, YouTube, Langsmith, Google Cloud Storage).

Related research broadens the picture. Mitiga's 'License to SKILL' (2026-02-17) demonstrated a 'Testing-Validator' skill whose Definition-of-Done silently pushed the entire codebase to an attacker-controlled remote, with commits attributed to the Cursor Agent and an empty skill-audit.log, distributed via skills.sh with inflated reputation. Mitiga's MCP token-theft research (disclosed to Anthropic 2026-04-10, classed out of scope 2026-04-12) chains a malicious npm postinstall hook that seeds trust in ~/.claude.json, a project-level SessionStart hook that rewrites the MCP server URL to a localhost mitmproxy, and re-runs on every load so token rotation is undone. Zenity (Black Hat USA 2026) found trojanized skills on skills.sh typosquatting Paperclip and Browser Use (~1.7M combined downloads by 2026-08-02) that told agents to install a credential stealer from attacker GitHub releases, with the payload hidden in a secondary file (setup-installation.md). No threat actor is attributed in any source; the in-the-wild instances are unattributed.

Impact per Mitiga: supply-chain compromise (a poisoned file in a popular template reaches every cloner), unauthorized access via MITM proxying, and credential theft. Affected tooling: Claude Code (Hooks, CLAUDE.md, ~/.claude.json), Anthropic Skills, Cursor, Cline, GitHub Copilot, Gemini CLI, Codex (AGENTS.md), aider, opencode, Continue, Windsurf and MCP configurations. No CVE exists. Mitiga released Skillgate, a free scanner (80+ rules) alongside the article.

MITRE ATT&CK techniques by tactic:

Collection

T1005 Data from Local System

Defense Evasion

T1027 Obfuscated Files or Information; T1036 Masquerading

Credential Access

T1056 Input Capture; T1528 Steal Application Access Token; T1552.001 Credentials In Files; T1557 Adversary-in-the-Middle

Execution

T1059.001 PowerShell; T1059.004 Unix Shell; T1204.002 Malicious File

Initial Access

T1195 Supply Chain Compromise; T1195.001 Compromise Software Dependencies and Development Tools; T1195.002 Compromise Software Supply Chain

Persistence

T1546 Event Triggered Execution

Impact

T1565 Data Manipulation

Exfiltration

T1567 Exfiltration Over Web Service

Remediation

Immediate actions

• Scan every committed instruction-file path (.cursorrules, .clinerules, .claude/, CLAUDE.md, AGENTS.md, GEMINI.md, .github/copilot-instructions.md, .continue/, mcp.json, hooks.json, settings.json, post-install scripts) and block merges with Direct Execution, Tool/MCP Poisoning or Credential Exposure findings until human sign-off
• Rotate any exposed API key/JWT and audit for unauthorized use before changing repo visibility; making a repo private is not enough because mirrors and code-search indexes cache secrets
• Remove malicious hooks and config rewrites (e.g. SessionStart hook, ~/.claude.json edits) BEFORE rotating MCP OAuth tokens, otherwise the hook re-captures them
• Review ANTHROPIC_BASE_URL overrides, hardcoded-IP MCP endpoints and auto-approve/YOLO settings in agent configs

Workarounds

• Disable auto-approve/YOLO mode and remove standing permission to fetch and execute external content
• Inspect skills before loading; treat silencing or allowlist instructions as red flags

Longer-term hardening

• Treat agent instruction files and skills as security-relevant code with review on creation or change; treat files imported with a repository as untrusted
• Baseline approved MCP endpoints and alert on new local proxies, new MCP servers, URL overrides and edits to ~/.claude.json and project-level MCP files
• Restrict agent/workstation egress and monitor traffic to Webhook.site, Pipedream, Supabase and the Telegram Bot API
• Re-scan instruction files on every model or agent upgrade; scan external repos before opening them in an editor
• Require security approval for external memory/MCP services; do not rely on stars, upvotes or publisher trust for skills

Affected and fixed versions

• Anthropic — Claude Code (Hooks, CLAUDE.md, ~/.claude.json) and Agent Skills (SKILL.md)
  Vulnerable versions: configuration-dependent; no version scope stated
• Anysphere — Cursor (.cursorrules)
  Vulnerable versions: configuration-dependent; no version scope stated
• Google — Gemini CLI (GEMINI.md)
  Vulnerable versions: configuration-dependent; no version scope stated
• Various — Cline, GitHub Copilot, Codex (AGENTS.md), aider, opencode, Continue, Windsurf, MCP server configurations
  Vulnerable versions: configuration-dependent; no version scope stated

Timeline

• 2026-02-17 Mitiga Labs publishes 'License to SKILL' (Breaking Skills part 1), demonstrating a Testing-Validator skill that silently pushes an entire codebase to an attacker-controlled remote, distributed via skills.sh.
• 2026-03-23 Mitiga initial discovery of MCP OAuth token theft in Claude Code via locked-ioc-3 trust seeding and SessionStart hook rewriting of MCP URLs.
• 2026-04-10 Mitiga reports the Claude Code MCP token-theft chain to Anthropic; acknowledged 2026-04-11 and classed out of scope 2026-04-12 citing user consent.
• 2026-05-05 Mitiga publishes 'Stealing MCP Tokens in Claude Code' describing the npm postinstall to locked-ioc-3 to localhost mitmproxy chain.
• 2026-06-15 Mitiga publishes the Skillgate research (prompt exfiltration, ANTHROPIC_BASE_URL overrides, 1,230+ hardcoded keys/JWTs) and releases the free Skillgate scanner.
• 2026-07-11 Per Zenity, attacker updates impersonating Paperclip and Browser Use skills on skills.sh with malicious instructions to install a credential stealer.
• 2026-08-02 Trojanized skills reach about 1.7 million combined downloads; trojanized npm and PyPI packages removed within hours, fallback to attacker GitHub releases.
• 2026-08-04 CSO Online reports Mitiga's PromptLogger cases: Supabase, locked-ioc-4 and Pipedream exfiltration sinks in poisoned .cursorrules, .clinerules, CLAUDE.md and locked-ioc-5 files.
• 2026-11-12 Mitiga updates the Skillgate article and related posts.

Sources cited

• Malware in AI Instruction Files: Spyware Skills and API Keys (Mitiga Labs, Idan Cohen) mitiga.io · Research · 2026-06-15
• Mitiga Labs - PromptLogger AI Instruction File Exfiltration Report mitiga.io · Research · 2026-08-04
• Mitiga Labs - Skillgate Whitepaper: The Hidden Attack Surface in AI Agent Instructions mitiga.io · Research · 2026-06-15
• Mitiga Labs - Stealing MCP Tokens in Claude Code mitiga.io · Research · 2026-05-05
• Mitiga Labs - License to SKILL: AI Agent Supply Chain Risk, Silent Codebase Exfiltration via Skills mitiga.io · Research · 2026-02-17
• Skillgate - free AI instruction-file scanner (Mitiga Labs) skillgate.mitiga.ai · Vendor report · 2026-06-15
• CSO Online - Attackers are crafting malicious AI instruction files to turn agentic workflows into quiet criminal helpers csoonline.com · News · 2026-08-04
• CSO Online - Trojanized AI skills gain 1.7M installs in agent-targeted attack (Zenity) csoonline.com · News · 2026-08-07

More in supply chain

• Cursor Supply-Chain Compromise: Leaked Fireworks AI Key Leads to Backdoored Anthropic.claude-code Extension (2.1.312/2.1.313) in Cursor Marketplace Cache
• nDiligence 'Attack the Glass' (ATG): Runtime Client-Side Rendering Supply-Chain Vulnerability Class Across 50 Platform Types
• Binance Hack: Tampered Homebrew Package Delivers macOS Stealer; Infostealers and AI-Powered Profiling Feed Social Engineering (TraderTraitor attribution)
• wfx-loot: GitHub Actions CI secret stealer pushed to public repositories using stolen GitHub credentials
• Quantum Systems QBase ground-control software update reportedly malware-laden; Bundeswehr drones grounded as precaution

Previous and next in supply chain

• Poisoned Take-Home Coding Test: AI Coding Agent-Driven Cloud Account Compromise via Indirect Prompt Injection Previous report
• Post-Training Supply Chain Backdoors Hijack Coding Agents (Dataset and Model Poisoning) Next report

Further reading

• TeamPCP Supply Chain Attack on Trivy, LiteLLM
• Axios Supply Chain Attack: Cross-Platform RATs
• npm Supply Chain Attacks 2026: 218 Packages