Untrusted Skills and MCP Content Cross Coding-Agent Trust Boundaries

Description

The paper describes indirect prompt-injection chains in agentic coding assistants where untrusted repository content, skill definitions, extension context, or MCP tool metadata is interpreted as instructions. Its novel skill-chain analysis identifies a concrete authorization weakness: skills can grant broad tool types such as Read or Bash without restricting permitted file targets, allowing repository-supplied instructions to influence sensitive reads or tool execution. The paper is a systematization and does not independently replicate its reported measurements; its platform ratings and attack-success figures are synthesized from cited work.

Examples

See the primary source for the paper's evaluation and defensive reproduction context: https://arxiv.org/abs/2601.17548 (opens in a new tab)

Impact

Successful injection can cause unauthorized sensitive-file access, credential or source-code exposure, unintended shell/tool execution, malicious code or configuration changes, and persistent compromise of coding workflows. The paper reports these impacts as attack objectives and conceptual exploit chains, not independently verified outcomes for every named platform.

Affected Systems

• Agentic coding assistants that ingest untrusted repository, issue, PR, documentation, or web content
• Skill-based coding-agent ecosystems with coarse Read/Bash permissions
• MCP-enabled coding assistants that trust tool descriptions or tool responses
• Claude Code skills
• GitHub Copilot and Copilot Extensions
• Cursor
• OpenAI Codex CLI
• Gemini CLI

Mitigation Steps

• Treat repository files, issues, PRs, documentation, skill definitions, MCP tool metadata, and tool responses as untrusted data rather than privileged instructions.
• Apply least-privilege capability scoping to specific files, directories, commands, OAuth scopes, and network destinations; do not grant unrestricted Read or Bash access.
• Require explicit human confirmation for shell execution, network requests, cross-project access, configuration changes, and other high-impact actions; block credential access by default.
• Sandbox tool execution per project with explicit mounts and strict outbound-network allowlists.
• Require signed, immutable, versioned tool and skill definitions to reduce tool squatting and post-approval rug pulls.
• Track provenance across context sources and validate proposed sensitive actions with an independent policy or guardian layer.
• Avoid relying only on keyword filters or prompt-injection classifiers, because the paper reports that adaptive attacks bypass many detection-based defenses.

Evidence

• https://arxiv.org/abs/2601.17548 (opens in a new tab) — abstract: the authors characterize the work as a Systematization of Knowledge covering prompt injection across skills, tools, MCP/protocol exploitation, and cross-origin context poisoning.
• https://arxiv.org/pdf/2601.17548 (opens in a new tab) — Section I-A (Methodology): the paper says attack-success and defense results are drawn from cited sources, primarily MCPSecBench, IDEsaster, and Nasr et al., and explicitly states that it did not conduct independent replication experiments.
• https://arxiv.org/pdf/2601.17548 (opens in a new tab) — Section III-C (Trust Boundaries): the paper identifies user-agent, agent-tool, tool-tool, and session boundaries and discusses how current implementations can violate them; the section does not provide a source or methodology for its aggregate platform-failure statistic, so that figure is intentionally omitted here.
• https://arxiv.org/pdf/2601.17548 (opens in a new tab) — Section V-E (Tool Poisoning Attacks): the paper describes MCP tool poisoning through malicious instructions embedded in tool descriptions, which agents may treat as trusted documentation.
• https://arxiv.org/pdf/2601.17548 (opens in a new tab) — Section VII-C (Skill-Specific Vulnerabilities): the paper presents a Claude Code skill-chain scenario and states that the weakness is coarse tool-type authorization without target restrictions, so a skill with Read access can read files beyond project scope.
• https://arxiv.org/pdf/2601.17548 (opens in a new tab) — Section VII-C: the paper describes a Copilot Extension chain involving broad OAuth scope, conversation-history exposure, and repository writes; this is presented as a conceptual exploit chain rather than an independently replicated experiment.
• https://arxiv.org/pdf/2601.17548 (opens in a new tab) — Sections VII-A and VII-B: the paper reports MCPSecBench coverage of 17 attack types across four surfaces, 85%+ compromise of at least one platform, and qualitative ratings for Claude Code, Copilot, Cursor, Codex CLI, and Gemini CLI; these are paper-reported synthesis results.
• https://arxiv.org/abs/2508.13220 (opens in a new tab) — MCPSecBench primary source: the benchmark defines 17 MCP attack types across four surfaces and reports that over 85% of the identified attacks successfully compromise at least one evaluated platform, supporting the synthesized measurement above.
• https://arxiv.org/pdf/2601.17548 (opens in a new tab) — Section VIII-C (Proposed Defense Framework): the paper recommends signed immutable tool definitions, fine-grained capability scoping, allowlisted egress, runtime intent verification, sandboxing, provenance tracking, and human approval gates.
• https://arxiv.org/pdf/2601.17548 (opens in a new tab) — Section VIII-D (Responsible Disclosure Considerations): the authors state that attack code is not released and techniques are described conceptually, so no safe reproducible artifact is provided by this paper.