Answer
What is the lethal trifecta for AI agents?
The lethal trifecta is private data, untrusted content and an outbound channel in one agent. Any two are manageable. All three let an attacker who can edit the content turn a reader into an exfiltration path.
Why is it a supply chain question?
The skill supplies the combination. A skill that reads a web page, an inbox or an issue tracker brings the untrusted content; a skill with a credential brings the private data; a skill with open network access brings the channel. The public ToxicSkills audit found 17.7 percent of skills fetching untrusted third-party content, which is a large surface for indirect prompt injection.
What does it look like in a manifest?
A skill with a network scope, a write or send tool and a secret in its environment. The checker reports the combination as SC-15, above the single-scope findings, because the risk is the combination rather than any one field.
How do you break it?
- Separate the reader from the actor: one skill reads, another acts, and the reader has no outbound channel.
- Keep the reader read-only and give it no secret.
- Put a person between the content and the action for anything that leaves the boundary.
Is it always malicious?
No. The combination is common in useful tools. That is why the finding is a question for the reviewer rather than a verdict on the publisher: it says the combination exists, and the fix is a design choice.
Source note. The term is used in the public research on agent skills; the manifest combination is our reading of the OWASP and MCP guidance. All sources.