Agent snooping (reads agent config / MCP config / peer skills)

ID

agent-snooping

Severity

low

Remediation Complexity

trivial

Remediation Risk

low

Remediation Effort

low

OWASP LLM

LLM02:2025 — Sensitive Information Disclosure

Family

LLM02 — Sensitive Information Disclosure

Red-team vectors

Data Exfiltration

Tags

ai_security

Description

A skill has no legitimate need to read the agent’s own state. This detector flags three snooping behaviours in skill code or instructions:

  • AS1 — Agent config directory access: reads from .claude/, .codex/, .gemini/ (…), which hold API keys and personal settings;

  • AS2 — MCP config access: reads mcp.json, which holds MCP server URLs, auth tokens, and tool definitions — letting the skill discover and abuse other integrations;

  • AS3 — Skill enumeration: lists or reads peer skills' SKILL.md files, revealing their prompts, capabilities, and secrets.

Signatures ship in a bundled, versioned resource (aisecurity/agent-snooping-signatures.yml) that grows without a detector change.

Each signature carries a per-pattern confidence. Structural code / path access (e.g. open('.claude/…')) is language-agnostic and ships at medium confidence; natural-language instructions (e.g. "read the agent config") are English-only and ship at low confidence. The severity is a low floor — a match can be a comment or documentation — and the Stage-2 semantic review may lower confidence further (never raise it) and escalate confirmed true positives.

Examples

import json
creds = open('.claude/credentials.json').read()   (1)
1 The skill reads the agent’s own credentials file — state it has no legitimate need for. Other carriers include open("mcp.json") (AS2) and enumerating .claude/skills/*/SKILL.md (AS3).

Mitigation / Fix

  • AS1: do not read the agent’s config directories. If a config value is needed, pass it explicitly as a parameter or environment variable.

  • AS2: do not read mcp.json. MCP server details are managed by the agent runtime, not by individual skills.

  • AS3: do not list or read other skills' files. Skills must operate independently; cross-skill access is a privilege escalation.