RESEARCH REPORT · MITIGA LABS

PromptLogger: The Hidden Exfiltration Layer in AI Instruction Files

A skill is just text. So is a rule file, a hook, a CLAUDE.md. Your coding agent reads them and acts on them automatically — and almost nobody opens them first. Mitiga Labs scanned the open-source ecosystem to find out what that trust is costing.

We found PromptLoggers: instruction files that quietly record the prompts, responses, environment variables, tokens, and deployment details flowing through a coding agent, then ship them to an attacker — with no malware, and often an empty audit log. This report walks six real cases from public repositories, shows exactly how the exfiltration works, and lays out how defenders recognize the pattern before an agent ever runs it.

What's inside:

The core finding — how rule files and hooks turn trusted coding assistants (Cursor, Claude, Gemini CLI, and more) into collection-and-exfiltration tools, no malware required
Six case studies from live public repositories — from a DevOps repo whose rules silently ran a command before every response, to enterprise agent configs leaking memory, MCP, and infrastructure detail
Where the data goes — the real exfiltration sinks observed (Supabase, webhook.site, Pipedream, Telegram) and why they're chosen
Why this evades your controls — plain-English instructions are harder to verify than traditional malware, and the behavior propagates into generated code, CI/CD jobs, and agent memory
Detection & response guidance — what to scan for, what to block on merge, how to restrict agent egress, plus referenced detection rules and indicators of compromise

Agents made instruction files powerful, and the ecosystem made them easy to share. This report is the evidence for why you look before you load one.

Who it's for

Security teams triaging AI tooling across an org, and the developers installing skills, rule files, and agent configs from public marketplaces.

About Mitiga Labs

Mitiga Labs is Mitiga's research division. This report is part of the "License to Skill" series on AI agent supply-chain attacks; Skillgate — the free scanner at skillgate.mitiga.ai — is part of that output. Pair this report with the companion Skillgate whitepaper, Breaking Skills: Securing the AI Agent Instruction Supply Chain.

PromptLogger: The Hidden Exfiltration Layer in AI Instruction Files

What's inside:

Who it's for

About Mitiga Labs

Get the full report