feat: AVE-2026-00069 -- multimodal image-hidden instructions (SkillCamo) - #116
Merged
chaksaray merged 2 commits intoAug 3, 2026
Merged
Conversation
Verified genuine gap: instructions concealed in an image bundled with a skill package, invisible to text-only scanners (documentation, manifest, source code), recovered by a multimodal agent at deployment. Distinct from AVE-2026-00037 (image/vision prompt injection at chat time, entry_class user_input) and AVE-2026-00028 (user-supplied file content): here the payload is a static resource shipped inside the skill package itself, present before any user interaction. Sourced from arXiv 2606.18198 (SkillCamo / ExecScan), evaluated against real skill scanners including Cisco, Snyk, and SkillVetter. mitre_atlas confirmed precisely against MITRE's own ATLAS data repository: AML.T0068 (LLM Prompt Obfuscation) explicitly names hiding instructions 'in the pixels of an image' as an in-scope multimodal example. owasp_mcp/owasp_asi researched against each framework's primary source (MCP03 Tool Poisoning; ASI01 Agent Goal Hijack -- genuinely verified this time, not pattern-matched; ASI04 Agentic Supply Chain Vulnerabilities). nist_ai_rmf left as a researched empty array: no subcategory specific enough to bundled-resource multimodal scanning found with confidence.
…9-skillcamo-image-hidden-instructions # Conflicts: # CHANGELOG.md # README.md # dist/ave-records-latest.json # dist/ave-records-latest.manifest.json
chaksaray
deleted the
feat/AVE-2026-00069-skillcamo-image-hidden-instructions
branch
August 3, 2026 15:05
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
AVE-2026-00069: multimodal image-hidden instructions, "SkillCamo" (MEDIUM, AIVSS 4.8). Fourth of five records from the eight-candidate verification audit's genuine gaps.
Why this is a genuine gap
Instructions concealed in an image file bundled inside a skill package, invisible to text-only scanners (documentation, manifest, source code -- the surface every current skill scanner covers), recovered by a multimodal agent at deployment. Distinct from the 4 records the original keyword sweep surfaced:
entry_class: user_input-- a user supplies the image/file mid-conversation. Here the payload ships inside the skill package itself, present before any user interaction at all.Sourcing
arXiv 2606.18198, "Seeing Is Not Screening: Multimodal Hidden Instruction Attacks on Agent Skill Scanners." SkillCamo conceals instructions in bundled images while rewriting surrounding documentation to naturally reference them; evaluated against real skill scanners including Cisco, Snyk, and SkillVetter. Also introduces ExecScan, a proposed defense.
Framework mappings, researched not assumed
mitre_atlas: ["AML.T0068"]confirmed precisely against MITRE's own ATLAS data repository: LLM Prompt Obfuscation explicitly names hiding instructions "in the pixels of an image" as an in-scope multimodal example.owasp_mcp: ["MCP03"](Tool Poisoning) andowasp_asi: ["ASI01", "ASI04"](Agent Goal Hijack; Agentic Supply Chain Vulnerabilities) verified against each framework's own published category list -- ASI01 genuinely fits here, unlike the earlier mistaken use on AVE-2026-00067.nist_ai_rmf: []: researched, no subcategory specific enough to bundled-resource multimodal scanning found with confidence rather than guessed.Validation
python3 scripts/validate_records.py: all 66 records valid.python3 scripts/check_fixtures.py: all 66 records have positive + negative fixtures.pytest tests/ -x -q: 264 passed.node scripts/build-records.js: dist regenerated; frozen v1.1.0 snapshot untouched.Scope notes
No detection-rule PR in bawbel/scanner -- separate tracker. One more record from the same audit sweep to follow.