Tp2
High
- Category
- MCP Tool Poisoning
- Confidence
- 85% confidence
- Finding
Mixing characters from multiple Unicode scripts in a single identifier is a common technique to create visually ambiguous tool names.
- Content
Security audit
Ai工作流 43de14
Security checks for vulnerabilities and agentic risk
Overview
This is a simple Chinese tutorial-style skill with broad triggers but no executable code, persistence, credential handling, or hidden authority.
Install only if you want a lightweight Chinese guide for Coze/AI workflow learning. Expect possible over-activation on generic AI workflow requests, and treat the listed video links as external references rather than verified platform content.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Vulnerability Patterns
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (3)
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The manifest trigger field contains ambiguous keywords like 'AI工作流' and '2026Coze' without boundaries, making accidental or overly frequent activation likely. In agent systems, imprecise trigger terms can misroute user requests and cause the skill to respond in contexts it was not designed to handle.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The trigger scenarios are broad enough to activate on generic user requests such as 'AI工作流' or general workflow help, which can cause this skill to be invoked outside its narrow intended tutorial context. Overbroad routing increases the chance of unintended skill selection, irrelevant responses, and prompt-surface expansion if other skills or user inputs are less trusted.
- Content