AVE-2026-00003.json

{
  "ave_id": "AVE-2026-00003",
  "schema_version": "1.1.0",
  "component_type": "skill",
  "title": "Credential exfiltration via agent instruction",
  "attack_class": "Data Exfiltration - Credential Theft",
  "description": "A skill file instructs the agent to read environment variables, configuration files, or credential stores and transmit their contents to an external destination. The agent follows these instructions as part of normal task execution, treating the credential collection as a legitimate step.",
  "affected_platforms": [
    "claude-code",
    "cursor",
    "codex",
    "any-agent-with-env-access"
  ],
  "affected_registries": [
    "clawhub.io",
    "smithery.ai",
    "skills.sh"
  ],
  "aivss_score": 6.8,
  "cvss_base_vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N",
  "owasp_asi": ["ASI01"],
  "owasp_mcp": [
    "MCP01"
  ],
  "nist_ai_rmf": [
    "MAP-1.5",
    "MEASURE-2.5",
    "MANAGE-1.3"
  ],
  "mitre_atlas": [
    "AML.T0048"
  ],
  "behavioral_fingerprint": "Component instructs agent to read and transmit environment variables, API keys, or other credentials to an external destination.",
  "behavioral_vector": [
    "credential-read",
    "data-exfil",
    "env-access"
  ],
  "provenance_vector": {
    "entry_class": "content",
    "payload_surface": "skill instruction body: environment/credential read + external send",
    "escalation": "instruction_to_capability"
  },
  "trifecta_profile": {
    "requires": [
      "private_data",
      "external_comms"
    ]
  },
  "mitigation": {
    "strategy": [
      "least_privilege",
      "sever_egress"
    ],
    "enforcement_point": "runtime_proxy",
    "trifecta_control": "break_external_comms"
  },
  "mutation_count": 12,
  "detection_methodology": "1. Static scan: search for patterns matching this attack class in component content.\n2. Semantic analysis: an LLM-based reviewer flags behavioral directives in component content.\n3. Behavioral sandbox: monitor agent behavior during initialization for unexpected actions.",
  "indicators_of_compromise": [
    "Component references os.environ, process.env, or similar environment access APIs",
    "Component instructs agent to read .env files, config files, or credential stores",
    "Component includes instructions to send or transmit data to an external URL or API",
    "Outbound network request containing credential-shaped data observed after skill execution"
  ],
  "aivss": {
    "cvss_base": 8.5,
    "aarf": {
      "autonomy": 1,
      "tool_use": 1,
      "multi_agent": 0,
      "non_determinism": 0.5,
      "self_modification": 0,
      "dynamic_identity": 0,
      "persistent_memory": 0,
      "natural_language_input": 1,
      "data_access": 1,
      "external_dependencies": 0.5
    },
    "aars": 5,
    "thm": 1,
    "mitigation_factor": 1,
    "aivss_score": 6.8,
    "aivss_severity": "MEDIUM",
    "spec_version": "0.8",
    "notes": "AARF scores reflect typical skill deployment in agentic workflows. See SPEC.md for factor definitions."
  },
  "remediation": "1. Remove the component immediately.\n2. Rotate all environment variables and API keys accessible to the agent.\n3. Review outbound network logs for credential-shaped data.\n4. Audit all tool calls and external requests made during the exposure window.",
  "status": "active",
  "kill_switch_active": false,
  "researcher": "Saray Chak",
  "researcher_url": "https://bawbel.io",
  "published": "2026-04-01T09:00:00Z",
  "last_updated": "2026-08-23T00:00:00Z",
  "references": [
    {
      "tag": "CWE-522",
      "text": "CWE-522: Insufficiently Protected Credentials \u2014 MITRE Common Weakness Enumeration",
      "url": "https://cwe.mitre.org/data/definitions/522.html"
    },
    {
      "tag": "MITRE ATT&CK T1552",
      "text": "MITRE ATT&CK \u2014 T1552: Unsecured Credentials",
      "url": "https://attack.mitre.org/techniques/T1552/"
    },
    {
      "tag": "OWASP LLM Sensitive Info",
      "text": "OWASP Top 10 for LLM Applications \u2014 Sensitive Information Disclosure",
      "url": "https://owasp.org/www-project-top-10-for-large-language-model-applications/"
    },
    {
      "tag": "AVE Registry",
      "text": "AVE-2026-00003 \u2014 AVE behavioral vulnerability registry",
      "url": "https://github.com/aveproject/ave/blob/main/records/AVE-2026-00003.json"
    }
  ],
  "severity": "MEDIUM",
  "evidence_kind_default": "multi_engine",
  "detection_stage": "static_detection",
  "detection_layer": "content",
  "confidence_baseline": 0.83,
  "evidence_basis_engines": [
    "pattern",
    "semgrep",
    "yara"
  ],
  "derivable_into": [],
  "framework_sources": {
    "owasp_mcp": {
      "commit": "165fe0f78ef104459237b4a8e0f6e78db9b02391",
      "read_date": "2026-09-05"
    },
    "mitre_atlas": {
      "pin_status": "unknown",
      "read_date": "2026-08-09"
    },
    "owasp_asi": {
      "version": "2026",
      "read_date": "2026-08-23"
    },
    "nist_ai_rmf": {
      "pin_status": "unknown",
      "read_date": "2026-10-15"
    }
  }
}