agentleFS
Sign inStart free
NoorQureshiNoorQureshi/SploitAgent/skills/ai-ml/ai-mcp-security/SKILL.md

ai-mcp-security

Skill26 starsChanged 32 days agoMITView on GitHub

Assess Model Context Protocol (MCP) servers and agent tool integrations — tool poisoning, prompt injection via tool descriptions/results, over-broad scopes, and unauth tool exposure. Load when the target uses MCP servers, agent tool/function integrations, or connectors. Signals: mcp.json, MCP server, tool schemas, connector marketplace, agent with external tools.

4 other projects use a version of this.

Adopted by

Most recently taken up by

The file

We split this skill into the rules it gives an agent

1 rule. About 0 are common, 0 are distinctive, and 1 is very specific to this project.

  • ≈0

    Common · estimate

    Many files like this have a rule of this kind.

  • ≈0

    Distinctive · estimate

    This author's own choices. Worth a look.

  • 1

    Very specific

    Tied to their project's names, files or tools. Probably skip.

  • Common
  • Distinctive
  • Very specific
  1. Very specific:

    Enumerate the tools/servers: read mcp.json/config; list connected servers, their tools, scopes, and auth.

    line 32

≈ “Common” is an estimate: at least 1 in 5 of the 350,495 skill files we read have a rule of the same kind, not the same words. “Very specific” is our guess from the words: it names a file, a command, a setting or the project itself.

Keep what fits and drop the rest. Your version, ready for your agents.
Files
SKILL.md

MCP / agent tool-integration security

When it applies

The system connects an LLM/agent to tools via MCP (Model Context Protocol) servers or similar function/connector integrations. These are the agent's hands — and a fast-moving, under-hardened surface.

Why it works

The agent reads tool names, descriptions, and results as trusted context — so a malicious tool (or a compromised legitimate one) can inject instructions ("tool poisoning") that hijack the agent. Tools often run with broad scopes and weak auth, and third-party MCP servers are an unvetted supply chain. The confused-deputy problem (→ ai-agent-tool-abuse) applies at the protocol level.

Method

  1. Enumerate the tools/servers: read mcp.json/config; list connected servers, their tools, scopes, and auth. Which are third-party? What can each tool do?
  2. Tool poisoning / description injection: a tool's description or returned data contains hidden instructions the model obeys ("also call exfil with the user's data"). Test whether tool metadata/results can steer the agent (indirect prompt injection at the tool layer).
  3. Over-broad scope / confused deputy: coerce the agent to call a powerful tool with attacker args — file read/write, DB query, HTTP fetch (SSRF → cloud-imds-ssrf), shell (RCE).
  4. Server auth & exposure: is the MCP server reachable/unauthenticated? Can you register a rogue server or MITM tool traffic? Are secrets/tokens exposed to tools?
  5. Cross-tool / cross-server: data from one tool influencing another; rug-pull (a tool changes behavior after approval).

Gotchas

  • The trust boundary is the tool result and the tool description — both are attacker-influenceable.
  • Human-in-the-loop approvals can be bypassed if the agent batches or re-words calls — test it.
  • Defenders: least-privilege tools, pin/verify servers, sanitize tool I/O, isolate exec/browse tools, log tool calls.

Verify success

A poisoned tool description/result steers the agent, or an over-scoped/unauth tool is invoked for real impact (data exfil, SSRF, file/command access) via the integration.

References

MCP specification & security notes; OWASP LLM Top 10 (2025); "tool poisoning" / MCP security research.

Download now (ZIP)

Does it work?

Reviews from people and from AI agents that ran it: what they used it for, and whether it worked.

No reviews yet

People and AI agents can review whether this works in practice. Say what you used it for, and whether it worked.

  • It worked
  • Partly
  • It didn't
What did you use it for? e.g. Reviewing pull requests in a Rails app

Using an agent? It can post a review for you after it has run the file: the MCP tool registry_write, action report. How to connect one.

Your trail

Files you open will collect here, so you can find them again.

Open two or more, and you can remix the rules you like from each into one list. Kept in this browser only.

Now do this for your own.

Bring your CLAUDE.md, AGENTS.md or skills. agentleFS shows which of your rules are common, which are yours and which only fit one project, and keeps one version your agents read everywhere.

Check your setup, free