Tp2
High
- Category
- MCP Tool Poisoning
- Confidence
- 85% confidence
- Finding
- Mixing characters from multiple Unicode scripts in a single identifier is a common technique to create visually ambiguous tool names.
Security audit
Frontend Skill 1.0.1
Security checks for vulnerabilities and agentic risk
Overview
This is a simple frontend-development guidance skill with broad but disclosed scope and no hidden code, credential access, persistence, or execution behavior.
Install only if you want a broadly scoped Chinese-language frontend helper that defaults to React, shadcn/ui, Tailwind CSS, TypeScript, and Next.js when you do not specify a stack. Review task requests carefully because the triggers are general frontend phrases, but the artifact itself contains no executable payload or hidden privileged behavior.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Vulnerability Patterns
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (7)
Tp2
High
- Category
- MCP Tool Poisoning
- Confidence
- 85% confidence
- Finding
- Mixing characters from multiple Unicode scripts in a single identifier is a common technique to create visually ambiguous tool names.
Tp2
High
- Category
- MCP Tool Poisoning
- Confidence
- 85% confidence
- Finding
- Mixing characters from multiple Unicode scripts in a single identifier is a common technique to create visually ambiguous tool names.
Natural-Language Policy Violations
Medium
- Confidence
- 95% confidence
- Finding
- The README's primary skill description is written entirely in Chinese and does not indicate that users may choose another language or locale. This creates a natural-language policy concern because it effectively imposes a language preference without opt-in or justification.
Vague Triggers
Medium
- Confidence
- 94% confidence
- Finding
- The manifest lists generic triggers such as “创建页面”, “开发组件”, “前端项目”, and “web开发” without any scope limits or exclusion conditions. These phrases are broad enough to match many ordinary requests, increasing the risk of unintended invocation.
Natural-Language Policy Violations
Low
- Confidence
- 76% confidence
- Finding
- The text says that when the user has no special stack requirement, the skill will default to a specific ‘mainstream cutting-edge’ frontend stack. This imposes a preference without explicitly offering the user a choice or confirming that the default is acceptable.
Vague Triggers
Low
- Confidence
- 82% confidence
- Finding
- The description presents the skill as an all-purpose frontend engineer skill, while the Overview section contains only a placeholder and does not specify boundaries, supported tasks, or non-goals. Without clear activation criteria, the skill may be selected in situations outside its intended scope.
Static analysis
No suspicious patterns detected.