MAL-AGENT Agent Prompt Injection and Tool Poisoning
The adversary is the repository author and the target is the coding agent that is about to clone, open, and act on the repository. The payload is plain text aimed at the model: an instruction planted in an agent-facing file, or in an MCP tool-definition description the client feeds to the model verbatim. Read before the agent runs, it is a deterministic text-scan catch; read by the agent, it is a hijack.
What Vulkro detects
Three classes, one finding per file per class, all High severity.
MAL-AGENT-001 (Medium confidence) fires on agent-facing prose that carries an imperative-to-the-assistant injection framing (ignore previous instructions, disregard the above, you are now, a system: role prefix, as an AI) co-located within a small window of source lines with an instruction to take a risky action: run or exec a command, pipe a fetch into a shell, send or exfiltrate a token, secret, or environment variable, add a dependency, or edit CI. Both halves are required and must be adjacent, because documentation legitimately says instructions and legitimately says run npm install.
MAL-AGENT-002 (High confidence for an explicit exfiltration verb, Medium otherwise) fires on an MCP tool-definition JSON whose tool description instructs the agent to exfiltrate secrets, run a command, or that itself carries an injection framing. A tool description is fed to the model as trusted capability text, so this is tool poisoning.
MAL-AGENT-003 (Medium confidence) fires on an invisible or zero-width character (U+200B-U+200D, U+2060, U+200E / U+200F, a mid-file U+FEFF) sitting next to instruction words in an agent-facing file: hidden instruction text a human reviewer cannot see but the model reads. It stays Medium because zero-width joiners have legitimate internationalisation and emoji uses.
Agent-facing files include a README the agent will summarise, a CLAUDE.md / AGENTS.md / .cursorrules it will treat as instructions, and files under .claude/ or .cursor/.
What this does not claim: it never certifies a repository safe. It deliberately trades recall for a low false-positive rate and stays silent on a normal README with setup steps and on a normal MCP tool description.
Remediation. Read the flagged text as data, never as instructions, and delete it from any file an agent ingests. When wiring MCP servers, review tool descriptions the same way you review code, and pin the server version so a description cannot change under you.
See also
- Confidence model - what
High,Medium, andLowmean for findings in this category. - Safety - what Vulkro does and does not access on your machine.
References
This page is generated by vulkro rules export <out-dir> from Vulkro's built-in detector catalogue. Edits made by hand are overwritten on the next regeneration.