Tp2
High
- Category
- MCP Tool Poisoning
- Confidence
- 85% confidence
- Finding
Mixing characters from multiple Unicode scripts in a single identifier is a common technique to create visually ambiguous tool names.
- Content
Security audit
低代码Ai 7bbc51
Security checks for vulnerabilities and agentic risk
Overview
This is a passive Markdown learning skill with messy, overbroad triggers but no commands, persistence, credential access, or destructive behavior.
Before installing, expect this skill to be low-risk but low-quality: it may activate on common terms like BBC or broad low-code AI phrases and may inject unrelated learning notes into a conversation. It should be cleaned up and given narrower, unique triggers.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Vulnerability Patterns
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (6)
Vague Triggers
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
A single-word trigger 'BBC' is extremely broad and likely to collide with common references to news, media, language learning, or unrelated content. This makes accidental activation highly probable and increases the risk that the skill's large, merged, and partially irrelevant context contaminates unrelated conversations or overrides better-matched skills.
- Content
Vague Triggers
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
The repeated single-word trigger 'BBC' remains dangerous for the same reason as above, and duplication increases the likelihood that the skill continues to match despite future partial edits. Repeated broad triggers amplify accidental invocation and make the skill harder to safely maintain or review.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The top-level trigger string uses very generic terms like '低代码AI', '自己写的代码', 'vs', and 'AI写的代码', which are likely to appear in ordinary conversation unrelated to this skill. Overbroad activation can cause the wrong skill to run, inject irrelevant instructions into unrelated sessions, and create an avenue for prompt-space hijacking through accidental invocation.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The activation condition includes broad language such as '用户需要低代码AI相关帮助', which can match many unrelated requests and makes invocation ambiguous. In a skill system, vague related-help routing increases the chance of unintended activation and cross-context instruction interference.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The trigger phrase 'BBC英语精听' is still broad enough to overlap with many user requests about English listening practice or BBC learning content, not this specific skill. Such collisions can misroute user interactions and expose the agent to irrelevant embedded instructions or noisy context from merged skill content.
- Content