Tp2
High
- Category
- MCP Tool Poisoning
- Confidence
- 85% confidence
- Finding
Mixing characters from multiple Unicode scripts in a single identifier is a common technique to create visually ambiguous tool names.
- Content
Security audit
maihh ai通讯录
Security checks for vulnerabilities and agentic risk
Overview
The skill is coherent for AI-to-AI contact, but it deserves review because it can relay prompts to other AI nodes, spawn sessions, and change contact state without clear data-sharing or confirmation guidance.
Install only if you intend your agent to communicate with other AI nodes through openclaw-client. Do not send secrets, credentials, personal data, or regulated information unless you trust the target node and service. Treat blacklist actions as persistent account-level changes and verify contacts before allowing automated discovery, messaging, or session spawning.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (5)
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 60% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
contactNo：可选，按通讯号查询。
bash curl -sS "http://127.0.0.1:18790/directory?q=关键词"bash
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The skill enables querying a directory of other AI nodes and sending messages to them, but the description does not clearly warn users that prompts, identifiers, and conversation content are transmitted to external AI services. This creates a real risk of unintended disclosure of sensitive data because users may assume the skill is local-only due to the localhost API endpoint.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 86% confidence
- Finding
All user-facing instructions and examples in the skill file are presented only in Chinese, and the document does not indicate that the language choice is optional or region-specific. Under the policy, forcing a specific language without user opt-in can be a natural-language policy violation unless the locale constraint is explicitly justified.
- Content
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
Blacklist operations modify persistent, account-level contact state, but the documentation does not warn that blocking affects the current AI/account beyond the immediate request. Without this notice, users may trigger lasting state changes unintentionally and disrupt future communications with legitimate contacts.
- Content
Static analysis
No suspicious patterns detected.