Tp2
High
- Category
- MCP Tool Poisoning
- Confidence
- 85% confidence
- Finding
Mixing characters from multiple Unicode scripts in a single identifier is a common technique to create visually ambiguous tool names.
- Content
Security audit
建筑学长AI工作流
Security checks for vulnerabilities and agentic risk
Overview
This skill is coherent for automating an interior-design workflow, but it asks the agent to perform broad automatic downloads, browser use, file packaging, and a daily download task without enough user control details.
Install only if you are comfortable with an agent helping manage project folders, downloads, generated images, budgets, and presentation files. Before using it, explicitly tell the agent where files may be saved, whether it may use your browser session, and whether any daily scheduled download task is allowed or should be skipped.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (4)
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The skill promises automatic requirement processing, reference-image downloads, file creation, renaming, budgeting output, PPT generation, and final packaging, but does not clearly warn the user about the scope of filesystem and data-handling actions. This creates a risk of unintended local data modification, storage of sensitive project materials, and surprise persistence of downloaded/generated content.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The workflow explicitly states it will automatically open a browser and download generated content from a website after the user signals completion, but it omits privacy, session, and network-operation warnings. In context, this is more dangerous because the agent may interact with authenticated browser state and external content, potentially exposing project data, downloading unexpected files, or performing unintended web actions under the user's session.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The trigger phrase is broad enough that the skill may activate on loosely related user requests, causing the agent to initiate a workflow involving file creation, downloads, and packaging without a tightly scoped user intent check. In an agent environment, overbroad invocation increases the chance of unintended side effects and makes social-engineering or prompt-confusion attacks easier.
- Content