What breaks when indirect prompt injection reaches an agent through Skills or MCP servers?

When Skills or MCP become the control plane, not just the transport

The break is not simply “bad text in, bad text out.” Once a skill or MCP server can influence the agent’s next action, untrusted content is no longer passive input, it becomes a control signal. That changes the security boundary: the agent is now making decisions with instructions that may have arrived through a channel the operator assumed was just data.

That is why prompt injection through tools, connectors, or hosted skills is so effective. The attacker does not need the user to paste a malicious prompt directly into the chat. They only need the agent to read content that it later treats as instruction-bearing context, which can convert ordinary retrieval, tool output, or server metadata into execution influence.

For agents using MCP, the issue is often compounded by delegation and trust propagation. A server that looks like a convenience layer can become a place where authorization, routing, or tool selection is shaped by content that should never have been allowed to steer runtime behaviour. NHIMG’s MCP Security Guide is useful here because it frames the server as a trust boundary, not just an integration endpoint.

The same pattern appears in skill ecosystems. A skill may be approved for a narrow task, but once the agent imports its instructions, examples, or configuration as operational context, the skill can affect planning, tool choice, and side effects beyond what a simple document would normally justify. NHIMG’s Agentic AI Security Guide covers that broader runtime problem well, especially where prompt injection blends into orchestration and tool use.

What actually breaks in the agent workflow

At the workflow level, three things tend to fail together. First, the agent loses the distinction between trusted instructions and untrusted content. Second, tool invocation becomes vulnerable to steered behaviour, such as sending data where it should not go or selecting an action the user never intended. Third, the chain of accountability weakens because the final action looks like a legitimate agent decision rather than a direct user command.

That matters because agents often operate with delegated authority. If the model is allowed to browse, call APIs, update records, or hand off to other tools, then a successful injection is not just a content integrity issue. It becomes an authorization and privilege problem: the wrong instruction can be executed with the right credentials.

This is why indirect prompt injection is more dangerous than a harmless jailbreak. The malicious content can sit inside a document, ticket, email, search result, or server response until the agent retrieves it at the wrong moment. NHIMG’s Browser and Computer-Use Agent Security Guide shows the same basic failure mode in another form, where the agent’s session becomes the lever that makes injected instructions operational.

In MCP environments, the failure can also look like tool output injection. If a server response is trusted too broadly, the agent may treat that output as evidence, policy, or instruction all at once. The result is a confused deputy pattern: the agent is doing the work, but the attacker is shaping the decision path through a channel that was supposed to be data-only.

Why this is a security problem, not just an AI one

The security problem is that the blast radius depends on what the agent can do after the injection lands. If the agent can access files, secrets, internal systems, or downstream tools, then the compromise can move from steering to exfiltration, misuse, or unintended execution. In practice, that means prompt injection can become a privilege abuse event rather than a mere model failure.

For practitioners, the key distinction is whether the agent is allowed to act on behalf of a user or service. If yes, then the injected content can trigger actions that have real business effect, including disclosure, modification, or destructive side effects. NHIMG’s OWASP Agentic Applications Top 10 is a good map for that risk because it ties prompt injection to tool misuse, identity and privilege abuse, and cascading failure modes.

The MCP angle is especially sensitive because servers often sit close to data sources and action endpoints. If token handling, tool permissions, or server trust are too broad, the attacker does not need to break the transport. They only need to shape the agent’s decisions well enough to make the transport carry the wrong intent.

Risk and Threat Considerations

Indirect prompt injection through skills or MCP servers can turn trusted integrations into covert command channels. The risk is highest when the agent has durable access to tools, secrets, or business systems, because the injected content can cause real actions before anyone notices the prompt source was hostile.

Failure mechanism: Untrusted content is interpreted as instruction-bearing context, so the agent follows attacker-shaped guidance during planning, tool selection, or response generation. In MCP settings, weak server trust, broad token scope, or token passthrough can let that steering reach privileged actions.

Impact: The agent may exfiltrate data, misuse tools, modify records, or propagate the attacker’s intent through delegated access. The organisation then has to investigate an apparently legitimate agent action chain, which slows containment and widens the effective blast radius.

Practitioner Guidance

What to verify: Confirm that skills, connectors, and MCP servers are treated as untrusted inputs unless they are explicitly authenticated, authorised, and constrained. If a server can influence tool calls, its output should be assumed capable of changing behaviour, not just content.

Decision rule: If the agent can reach sensitive actions, require a narrow trust boundary around each tool and server, and separate retrieval from execution wherever possible. Do not let “helpful context” and “authorised instruction” share the same pathway unless you can prove the distinction is enforced.

What good looks like: The agent can read external or semi-trusted content without letting that content redefine its goals, permissions, or action sequence. The safest runtime is the one where a poisoned source can influence what is seen, but not what is authorised.

Practitioner takeaway: Indirect prompt injection becomes dangerous when the agent is allowed to act, not merely to answer. Design every skill and MCP server as though its output might be adversarial, because once context can steer execution, the real control plane is no longer the user prompt.

Related resources from NHI Mgmt Group

• What breaks when indirect prompt injection reaches a browser agent?
• What breaks when AI agent skills can change agent behaviour through prompt injection?
• What breaks when prompt injection reaches an ecommerce agent?
• What breaks when prompt injection reaches a tool-using AI agent?