Tp2
High
- Category
- MCP Tool Poisoning
- Confidence
- 85% confidence
- Finding
Mixing characters from multiple Unicode scripts in a single identifier is a common technique to create visually ambiguous tool names.
- Content
Security audit
Ai绘画 Ddcd9b
Security checks for vulnerabilities and agentic risk
Overview
This is a text-only AI art learning guide with messy promotional content, but it does not contain code, persistence, credential access, or hidden execution behavior.
Install only if you want a rough Chinese-language AI art reference skill. Expect broad activation on generic AI-art wording, and do not rely on its repeated "no sensitive prompt" claims as permission to bypass platform safety rules.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Vulnerability Patterns
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (7)
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The manifest trigger field contains generic phrases like 'AI绘画' and broad course-marketing terms that are likely to overlap with normal conversation. This can lead to accidental invocation and skill hijacking of common AI-art requests, especially because the skill aggregates multiple loosely related sources.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The trigger scenarios are broad enough to activate on ordinary user requests such as 'AI绘画' or similarly generic help-seeking language. Overbroad activation can cause unintended routing, making the agent invoke this skill in contexts where the user did not intend it, which increases exposure to the skill's embedded promotional and bypass-oriented content.
- Content
Ssd 2
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The phrase '无敏感提示词' explicitly frames the tool as avoiding sensitive prompt restrictions, which is a moderation-evasion signal rather than a normal product feature. In a skill that can be automatically triggered, this language may encourage or normalize bypassing safety controls for image generation systems.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
Using a generic term like '免费' as a trigger creates a high risk of collision with everyday speech unrelated to this skill. Because the surrounding content includes tool promotion and safety-evasion phrasing, accidental activation may expose users to bypass-oriented suggestions in unrelated conversations.
- Content
Ssd 2
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The duplicated section repeats both the generic triggering pattern and the '无敏感提示词' framing, reinforcing moderation-avoidance semantics and increasing the chance this content is surfaced. Repetition across merged sections makes the issue more dangerous because it amplifies unsafe cues and broadens the routes by which the skill can be activated.
- Content
Ssd 2
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
This is another repeated instance of wording that advertises absence of sensitive-prompt constraints, which can be interpreted as facilitating moderation bypass. In context, the repetition is not incidental metadata; it is persistent promotional language embedded in an auto-merged skill, increasing the likelihood of unsafe activation and guidance.
- Content