Tool Description Injection
Embed malicious instructions in tool or skill descriptions that execute when the agent processes them
Tactic
Initial Access (Stage 2)
Gain control over agent behavior through prompt manipulation or input exploitation
Attack Class
SKILL-FRONTMATTER
Embedding malicious instructions in skill or plugin metadata and description fields
Evidence
Confirmed in real-world production systems or internet-wide exposure assessments.
DVAA Validation
Reproductions in Damn Vulnerable AI Agent, the OpenA2A intentionally-broken agent for kill-chain validation.
PluginBot
Honeypot Coverage (AgentPwn)
An AgentPwn trap page produces a payload tagged with this technique class. Following the AgentPwn taxonomy of trap pages shows what an agent encounters.
Evidence Source Breakdown
Evidence Timeline
Shodan May 12, 2026 sweep: 38,976 exposed tools services indexed
HMA check SKILL-004 failed on fake-vulnerable-agent
HMA check SKILL-004 failed on fake-vulnerable-agent
HMA check SKILL-001 failed on opena2a/code-review-skill
HMA check SKILL-001 failed on opena2a/code-review-skill
HMA check SKILL-004 failed on fake-vulnerable-agent
HMA check SKILL-001 failed on damn-vulnerable-ai-agent
HMA check SKILL-001 failed on hackmyagent-release-test-vplv
Detection (HackMyAgent)
npx hackmyagent secure --ciLive = check implemented in hackmyagent; queued = declared, not yet implementedDefense (OASB Controls)
How to Cite
AI Agent Threat Matrix T-2005 (Tool Description Injection). OpenA2A, 2026. https://threats.opena2a.org/techniques/T-2005