Paper Reveals MCP Skills Chain Attacks That Bypass Permission Checks

In October 2026, a paper pointed out that MCP's Skills mechanism is vulnerable to chain attacks: an attacker can combine multiple Skills to bypass the permission checks of any single Skill. On October 6, an author on DEV Community published a roughly 100-line Python checker called chain_check.py that uses two rules to detect this kind of chained Skill approval hijacking. The single-Skill rule flags any Skill whose text contains both a state-changing action (upload, send, delete, transfer) and an approval declaration. The chain rule builds a write-read graph across installed Skills and flags paths where A writes to a file containing an approval declaration and B reads it and then performs a state-changing action. So far, progress is still limited to detection tooling—no official fix or platform-side response has appeared.

Generated by AI from reports · Updated 7 hours ago