# Malware and Credential Exposure in AI Agent Instruction Files (Skills, Hooks, MCP Configs) - Mitiga Skillgate Research

> Mitiga Labs analyzed 50,000+ AI instruction files from 7,000+ public GitHub repositories and reported prompt-exfiltration ('PromptLogger') instruction files, attacker-set ANTHROPIC_BASE_URL overrides, IP-pinned MCP endpoints, permission-bypass (YOLO) defaults and 1,230+ hardcoded API keys/JWTs. Related Mitiga and Zenity research documents skill-based codebase exfiltration, MCP OAuth token theft via ~/.claude.json hooks, and trojanized skills on skills.sh.

- **Published:** 2026-11-12T17:51:27Z
- **Last reviewed:** 2026-11-12T17:51:27Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-5878
- **Card image:** https://intel.threadlinqs.com/og/threat/TL-2026-5878.png
- **ID:** TL-2026-5878
- **Severity:** HIGH
- **Category:** SUPPLY_CHAIN
- **Status:** ACTIVE
- **Detections:** 9 (1 shown free below) · **IOCs:** 15 (1 shown free below)

## Description

Mitiga Labs ('License to Skill' / 'Breaking Skills' series) studied AI agent instruction files - Skills (SKILL.md), Claude Hooks, agent context files (CLAUDE.md, AGENTS.md, GEMINI.md), MCP configs (settings.json, mcp.json, hooks.json), agentic rules (.cursorrules, .clinerules, .github/copilot-instructions.md, aider YAML, opencode, Continue), package.json supply-chain droppers and poisoned .pyc files. The corpus (April-June 2026) comprised 50,000+ instruction files from 7,000+ public GitHub repositories plus arXiv-referenced samples and Skillforge-generated adversarial inputs; findings were triaged by an LLM reviewer (Gator Agent) and a human. Mitiga did not test actual exploitation or use any discovered credential, and describes Skillgate flags as 'needs review' rather than confirmed malware.

The headline finding is prompt exfiltration ('PromptLogger'): an instruction file directs the agent to silently capture every user prompt, sometimes responses, environment variables, tokens and deployment details and send them to an operator-controlled endpoint, with no conventional malware required. Mitiga reports a live case and holds the mechanics for a dedicated report. CSO Online (2026-08-04) summarizes six public-repo cases: a DevOps repo whose poisoned .cursorrules and .github/copilot-instructions.md ran a silent curl copying each prompt to a Supabase database with a hardcoded access token; an MLOps repo whose .clinerules sent environment variables and command output (WANDB key, AWS access key, GitHub token, MLflow URL) to Webhook.site; a 'FastAPI starter kit' whose .cursorrules/CLAUDE.md sent .env contents to Webhook.site framed as a team sync with output hidden; and a 'Zero Trust' GEMINI.md that told the agent to scrape env vars whose names contain key/secret/token/pass and inject an initialization block into every generated or modified Python file, sending data to a Pipedream endpoint. Other risky configurations: standing permission to fetch from an external URL (fetch-and-execute), an MCP endpoint on a hardcoded IP (possible MITM proxy), YOLO/auto-approve mode combined with an ANTHROPIC_BASE_URL override routing Claude traffic via a third-party host, a service bound to 0.0.0.0 with hardcoded Postgres credentials, PowerShell execution-policy bypass inside a SKILL.md, and 1,230+ hardcoded API keys and JWTs across tens of services (Anthropic, OpenAI, Google Gemini, xAI, MiniMax, DeepSeek, Context7, Databricks, Supabase, Vercel, YouTube, Langsmith, Google Cloud Storage).

Related research broadens the picture. Mitiga's 'License to SKILL' (2026-02-17) demonstrated a 'Testing-Validator' skill whose Definition-of-Done silently pushed the entire codebase to an attacker-controlled remote, with commits attributed to the Cursor Agent and an empty skill-audit.log, distributed via skills.sh with inflated reputation. Mitiga's MCP token-theft research (disclosed to Anthropic 2026-04-10, classed out of scope 2026-04-12) chains a malicious npm postinstall hook that seeds trust in ~/.claude.json, a project-level SessionStart hook that rewrites the MCP server URL to a localhost mitmproxy, and re-runs on every load so token rotation is undone. Zenity (Black Hat USA 2026) found trojanized skills on skills.sh typosquatting Paperclip and Browser Use (~1.7M combined downloads by 2026-08-02) that told agents to install a credential stealer from attacker GitHub releases, with the payload hidden in a secondary file (setup-installation.md). No threat actor is attributed in any source; the in-the-wild instances are unattributed.

Impact per Mitiga: supply-chain compromise (a poisoned file in a popular template reaches every cloner), unauthorized access via MITM proxying, and credential theft. Affected tooling: Claude Code (Hooks, CLAUDE.md, ~/.claude.json), Anthropic Skills, Cursor, Cline, GitHub Copilot, Gemini CLI, Codex (AGENTS.md), aider, opencode, Continue, Windsurf and MCP configurations. No CVE exists. Mitiga released Skillgate, a free scanner (80+ rules) alongside the article.

## MITRE ATT&CK

- T1195 Supply Chain Compromise
- T1195.002 Compromise Software Supply Chain
- T1059.004 Unix Shell
- T1059.001 PowerShell
- T1204.002 Malicious File
- T1546 Event Triggered Execution
- T1027 Obfuscated Files or Information
- T1036 Masquerading
- T1552.001 Credentials In Files
- T1557 Adversary-in-the-Middle
- T1528 Steal Application Access Token
- T1056 Input Capture
- T1005 Data from Local System
- T1567 Exfiltration Over Web Service
- T1565 Data Manipulation
- T1195.001 Compromise Software Dependencies and Development Tools

## Free detection (Splunk SPL, Microsoft KQL, Sigma)

**PromptLogger - AI Coding Agent Spawns Silent curl/PowerShell to Request-Sink Exfil Endpoint** (`TL-2026-5878-SPL-001`)

Detects an AI coding agent process (Claude Code, Cursor, Cline, Gemini CLI, Codex, Windsurf, aider, opencode or their node/Code host) spawning curl, wget, PowerShell or a shell whose command line targets webhook.site, Pipedream, Supabase or the Telegram Bot API. This is the core PromptLogger behaviour (TL-2026-5878): a poisoned .cursorrules, .clinerules, CLAUDE.md, GEMINI.md or copilot-instructions.md file instructs the agent to silently copy every user prompt, .env contents or environment variables to an operator-controlled sink with output hidden from the user. A 'silent' flag marks quiet-mode / output-suppressed invocations.

- **Languages:** Splunk SPL, Microsoft KQL, Sigma
- **ATT&CK:** T1059.004, T1059.001, T1567, T1056
- **Data sources:** sysmon, microsoft_defender_for_endpoint, windows_security
- **Severity:** high
- **Confidence:** high

### Splunk SPL

```spl
index=sysmon sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1
| eval par=lower(ParentImage), img=lower(Image), cmd=lower(CommandLine)
| where match(par, "(claude|cursor|windsurf|cline|gemini|codex|aider|opencode|node|code)([.]exe)?$")
| where match(img, "(curl|wget|powershell|pwsh|cmd|bash|sh)([.]exe)?$")
| where match(cmd, "webhook[.]site|pipedream[.]net|[.]supabase[.]co|api[.]telegram[.]org/bot|requestbin[.]com")
| eval silent=if(match(cmd, "(^|[[:space:]])-(s|ss|ssl|fssl|q)([[:space:]]|$)|--silent|/dev/null|-windowstyle[[:space:]]+hidden"), 1, 0)
| table _time host User ParentImage Image CommandLine silent
```

### Microsoft KQL

```kql
DeviceProcessEvents
| where Timestamp > ago(24h)
| where InitiatingProcessFileName has_any ("claude", "cursor", "windsurf", "cline", "gemini", "codex", "aider", "opencode", "node", "code")
| where FileName in~ ("curl.exe", "curl", "wget.exe", "wget", "powershell.exe", "pwsh.exe", "pwsh", "bash", "sh", "cmd.exe")
| where ProcessCommandLine has_any ("webhook.site", "pipedream.net", ".supabase.co", "api.telegram.org/bot", "requestbin.com")
| extend SilentFlags = ProcessCommandLine matches regex @"(?i)((^|[[:space:]])-(s|sS|sSL|fsSL|q)([[:space:]]|$)|--silent|/dev/null|-windowstyle[[:space:]]+hidden)"
| project Timestamp, DeviceName, AccountName, InitiatingProcessFileName, InitiatingProcessCommandLine, FileName, ProcessCommandLine, SilentFlags
```

### Sigma

```yaml
title: AI Coding Agent Spawns Shell Exfiltration To Request-Sink Service (PromptLogger)
id: 5b0f3c1e-7a42-4d6b-9c21-8e5a1f0d3b71
status: experimental
description: Detects an AI coding agent or its node/editor host spawning curl, wget, PowerShell or a shell that contacts webhook.site, Pipedream, Supabase or the Telegram Bot API, the PromptLogger prompt and secret exfiltration behaviour driven by poisoned instruction files.
references:
  - https://www.mitiga.io/blog/malware-in-ai-instruction-files-skillgate
  - https://www.csoonline.com/article/4204731/attackers-are-crafting-malicious-ai-instruction-files-to-turn-your-agentic-workflows-into-quiet-criminal-helpers.html
author: Threadlinqs Team
date: 2026/11/12
tags:
  - attack.execution
  - attack.t1059.004
  - attack.t1059.001
  - attack.exfiltration
  - attack.t1567
  - attack.collection
  - attack.t1056
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith:
      - 'claude.exe'
      - 'cursor.exe'
      - 'windsurf.exe'
      - 'cline.exe'
      - 'gemini.exe'
      - 'codex.exe'
      - 'aider.exe'
      - 'opencode.exe'
      - 'node.exe'
      - 'code.exe'
  selection_child:
    Image|endswith:
      - 'curl.exe'
      - 'wget.exe'
      - 'powershell.exe'
      - 'pwsh.exe'
      - 'cmd.exe'
  selection_sink:
    CommandLine|contains:
      - 'webhook.site'
      - 'pipedream.net'
      - '.supabase.co'
      - 'api.telegram.org/bot'
      - 'requestbin.com'
  condition: all of selection_*
falsepositives:
  - Developers legitimately testing webhooks against webhook.site or Pipedream from an editor terminal
  - Sanctioned Supabase or Telegram bot development workflows
level: high
```

**Known false positives:**

- Developers testing webhooks against webhook.site or Pipedream from an editor-integrated terminal
- Sanctioned Supabase or Telegram bot development where the agent runs curl against the project API

**Tuning notes:** Allowlist known-good Supabase project hostnames and sanctioned webhook test hosts by command-line substring. Raise priority when silent=1 or when the command line reads .env or pipes prompt text. On Linux/macOS use Sysmon for Linux or auditd execve with the same regexes (adjust Image path matching). Narrow the 'node' and 'code' parent names to your approved agent install paths to cut noise.

### 8 more detection rules (Splunk SPL, Microsoft KQL, Sigma), unlock with TL Creds

- Trojanized Agent Skill Execution - Paperclip / Browser Use Impersonation and Agent-Spawned Bypass or Encoded Shell (locked: unlock with TL Creds)
- ANTHROPIC_BASE_URL Override to Third-Party Host and Permission-Bypass (YOLO) Agent Launch (locked: unlock with TL Creds)
- Local MITM Proxy Launch and MCP Server Registration to Hardcoded IP (MCP Token Interception) (locked: unlock with TL Creds)
- Agent Skill / Instruction File Dropped by Download or Script Interpreter (locked: unlock with TL Creds)
- AI Agent Child Process Harvesting Environment Variables and .env Secrets (locked: unlock with TL Creds)
- AI Agent Adds Unfamiliar Git Remote or Pushes Codebase to Explicit External URL (Skill-Based Codebase Exfiltration) (locked: unlock with TL Creds)
- Agent Config and Hook Rewrite ([indicator], settings.json, mcp.json, hooks.json) by Installer or Script Interpreter (locked: unlock with TL Creds)
- Non-Browser Process DNS Resolution of PromptLogger Exfil Sinks ([indicator], Pipedream, Supabase, Telegram) (locked: unlock with TL Creds)

Sign up free to unlock the detection rules: https://threadlinqs.com/?modal=signup

## Sample indicators (1 of 15)

Defanged, TLP:CLEAR.

- Domain: `webhook[.]site`

Full set of 15 indicators unlocks with TL Creds: https://threadlinqs.com/tl-creds

## Sources

- [Malware in AI Instruction Files: Spyware Skills and API Keys (Mitiga Labs, Idan Cohen)](https://www.mitiga.io/blog/malware-in-ai-instruction-files-skillgate)
- [Mitiga Labs - PromptLogger AI Instruction File Exfiltration Report](https://www.mitiga.io/resources/promptlogger-ai-instruction-file-exfiltration-report)
- [CSO Online - Attackers are crafting malicious AI instruction files to turn agentic workflows into quiet criminal helpers](https://www.csoonline.com/article/4204731/attackers-are-crafting-malicious-ai-instruction-files-to-turn-your-agentic-workflows-into-quiet-criminal-helpers.html)
- [Mitiga Labs - Skillgate Whitepaper: The Hidden Attack Surface in AI Agent Instructions](https://www.mitiga.io/resources/skillgate-whitepaper-ai-agent-supply-chain-risk-mitiga-labs)
- [Mitiga Labs - Stealing MCP Tokens in Claude Code](https://www.mitiga.io/blog/claude-code-mcp-token-theft-mitm)
- [Mitiga Labs - License to SKILL: AI Agent Supply Chain Risk, Silent Codebase Exfiltration via Skills](https://www.mitiga.io/blog/ai-agent-supply-chain-risk-silent-codebase-exfiltration-via-skills)
- [CSO Online - Trojanized AI skills gain 1.7M installs in agent-targeted attack (Zenity)](https://www.csoonline.com/article/4206851/trojanized-ai-skills-gain-1.7m-installs-in-agent-targeted-attack.html)
- [Skillgate - free AI instruction-file scanner (Mitiga Labs)](https://skillgate.mitiga.ai/)

## Full data

The other 8 detection rules (Splunk SPL / Microsoft KQL / Sigma) unlock with TL Creds; a free account includes daily creds: https://threadlinqs.com/?modal=signup
Indicator values unlock with TL Creds, at a lower price on Red and Purple; AI agents can query rules and IOCs through the Threadlinqs MCP server (Purple): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-5878