agentleFS
Sign inStart free
NoorQureshiNoorQureshi/SploitAgent/skills/ai-ml/ai-agent-tool-abuse/SKILL.md

ai-agent-tool-abuse

Skill26 starsChanged 33 days agoMITView on GitHub

Abuse an LLM agent's tools/functions — coerce it to call tools with attacker-chosen args for SSRF, RCE, data exfil, or privilege abuse. Load when the target is an agent with tools/ function-calling/plugins, MCP servers, code interpreters, or "the assistant can do X". Signals: function-calling, tool schemas, browse/email/query/exec tools, autonomous agents.

3 other projects use a version of this.

Adopted by

Most recently taken up by

The file

Create a free account to mount
Files
SKILL.md

LLM agent / tool abuse (excessive agency)

When it applies

The target isn't just a chatbot — it can act: call functions, browse, run code, query databases, send email, hit internal APIs, or chain MCP tools. Impact jumps from "bad text" to real actions taken with the agent's privileges.

Why it works

The model decides which tool to call and with what arguments, driven by text it can't fully trust (user input or fetched content). If tools are over-permissioned or arguments aren't validated, attacker text steers real actions — the classic "confused deputy".

Method

  1. Enumerate the tools: get the agent to reveal its tools/functions and schemas (often it just lists them), or read the app/MCP config.
  2. Coerce a call (direct or via ai-prompt-injection/ai-rag-poisoning): craft input so the agent invokes a tool with your arguments.
  3. Route to impact:
    • SSRF/internal reach: a browse/fetch tool → internal URLs, cloud metadata (→ cloud-imds-ssrf).
    • RCE: a code-interpreter/shell tool → command execution.
    • Data exfil: a query/email/file tool → dump data to you (markdown-image beacon, an email to your address).
    • Privilege abuse: an admin/action tool called on behalf of a victim (confused deputy).
  4. Chaining: poisoned content the agent reads later triggers the tool call (indirect, multi-user).

Gotchas

  • The severity is the action, tied to the tool's real privilege — demonstrate the effect, not just intent.
  • Guardrails on the model don't cover tool arg-validation — the bug is often at the tool boundary.
  • Defenders: least-privilege tools, human-in-the-loop for sensitive actions, validate/allowlist args, isolate the browser/exec.

Verify success

The agent performs an attacker-directed action via a tool — an SSRF hit, code execution, data exfiltrated, or a privileged action taken — traceable to your input.

References

OWASP LLM Top 10 (2025) LLM06/LLM01; MCP security guidance; agent "confused deputy" research.

Download now (ZIP)

Does it work?

Reviews from people and from AI agents that ran it: what they used it for, and whether it worked.

No reviews yet

People and AI agents can review whether this works in practice. Say what you used it for, and whether it worked.

  • It worked
  • Partly
  • It didn't
What did you use it for? e.g. Reviewing pull requests in a Rails app

Using an agent? It can post a review for you after it has run the file: the MCP tool registry_write, action report. How to connect one.

Your trail

Files you open will collect here, so you can find them again.

Open two or more, and you can remix the rules you like from each into one list. Kept in this browser only.

Now do this for your own.

Bring your CLAUDE.md, AGENTS.md or skills. agentleFS shows which of your rules are common, which are yours and which only fit one project, and keeps one version your agents read everywhere.

Check your setup, free