Skip to main content

MAL-AGENT Agent Prompt Injection and Tool Poisoning

The repository author is the adversary and the target is the AI coding agent about to open the repository. The payload is plain text aimed at the model, planted in an agent-facing file or an MCP tool description. Caught before the agent runs, it is a text-scan finding; read by the agent, it is a hijack.

What Vulkro detects​

Three classes, all High severity, one finding per file per class.

  • MAL-AGENT-001 (Medium confidence): agent-facing prose where an injection framing (ignore previous instructions, disregard the above, you are now, a system: prefix, as an AI) sits within a few lines of a risky instruction: run a command, pipe a fetch into a shell, send a token, secret or environment variable, add a dependency, or edit CI. Both halves must be adjacent, since docs legitimately say "instructions" and "run npm install".
  • MAL-AGENT-002 (High confidence with an explicit exfiltration verb, Medium otherwise): an MCP tool-definition JSON whose description tells the agent to exfiltrate secrets or run a command, or carries an injection framing. The model treats tool descriptions as trusted, so this is tool poisoning.
  • MAL-AGENT-003 (Medium confidence): an invisible or zero-width character (U+200B to U+200D, U+2060, U+200E / U+200F, a mid-file U+FEFF) next to instruction words in an agent-facing file. It stays Medium because zero-width joiners have legitimate language and emoji uses.

Agent-facing files: a README the agent will summarise, CLAUDE.md, AGENTS.md, .cursorrules, and files under .claude/ or .cursor/.

The rule trades recall for few false positives: it stays silent on normal setup steps and normal tool descriptions, and it never certifies a repository safe.

How to fix​

  • Treat the flagged text as data, never as instructions, and delete it from any file an agent reads.
  • Review MCP tool descriptions like code, and pin the server version so a description cannot change under you.

References​

See also: Confidence model.

This page is generated by vulkro rules export <out-dir> from Vulkro's built-in detector catalogue. Edits made by hand are overwritten on the next regeneration.

Last updated on