Credential Access with Exfiltration in Skill Instructions - ATR-2026-00162 (1b38522c-1a65-5b4e-a9ee-1ef149a50e5b)
Detects SKILL.md files that combine credential file access (SSH keys, AWS credentials, API tokens) with outbound data transmission (curl POST, wget, HTTP request). Distinguishes real attacks from security documentation by requiring both access AND exfiltration in the same context.