Tp2
High
- Category
- MCP Tool Poisoning
- Confidence
- 85% confidence
- Finding
Mixing characters from multiple Unicode scripts in a single identifier is a common technique to create visually ambiguous tool names.
- Content
Security audit
WLS运行时工程师 WLS进程稳定
Security checks for vulnerabilities and agentic risk
Overview
This skill is a scoped WLS runtime-maintenance guide with disclosed process-testing behavior and no executable payloads.
Install this only in WLS projects where you expect the agent to inspect runtime documentation, edit process-lifecycle code when asked, and run a temporary dedicated test instance on port 9502 or higher. Confirm that any test instance is stopped after validation.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Vulnerability Patterns
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (6)
Skill Enumeration
Medium
- Category
- Agent Snooping
- Confidence
- 81% confidence
- Finding
The skill explicitly enumerates internal file paths and supporting skill names, which can leak repository structure and internal capabilities to anyone who can view the skill. In isolation this is low severity, but in an agent environment it can aid reconnaissance by helping an attacker map available guidance, target follow-on prompt injection against referenced materials, or infer platform-specific process-control behaviors.
- Content
md - `AI-ENTRY.md` - `CLAUDE.md` - `dev/ai/skills/weline-framework-runtime/SKILL.md` - `dev/ai/skills/runtime-and-process/SKILL.md` - `dev/ai/skills/windows-command-quoting/SKILL.md` - `dev/ai/skills/code-generation-standards/SKILL.md`
Skill Enumeration
Medium
- Category
- Agent Snooping
- Confidence
- 81% confidence
- Finding
This line reveals another internal skill path, contributing to capability and layout enumeration of the agent's codebase. Although not directly exploitable by itself, it gives attackers more precise knowledge of process/runtime-related modules they may try to manipulate through social engineering or prompt-targeted attacks.
- Content
md - `AI-ENTRY.md` - `CLAUDE.md` - `dev/ai/skills/weline-framework-runtime/SKILL.md` - `dev/ai/skills/runtime-and-process/SKILL.md` - `dev/ai/skills/windows-command-quoting/SKILL.md` - `dev/ai/skills/code-generation-standards/SKILL.md`
Skill Enumeration
Medium
- Category
- Agent Snooping
- Confidence
- 84% confidence
- Finding
Exposing the existence and path of a windows-command-quoting skill is more sensitive than generic documentation because it advertises platform-specific command-construction logic, an area commonly associated with command injection risk. In a runtime/process-control skill, this additional context can help an attacker infer how commands may be built and which adjacent components to target for exploitation or prompt manipulation.
- Content
md - `CLAUDE.md` - `dev/ai/skills/weline-framework-runtime/SKILL.md` - `dev/ai/skills/runtime-and-process/SKILL.md` - `dev/ai/skills/windows-command-quoting/SKILL.md` - `dev/ai/skills/code-generation-standards/SKILL.md` # Responsibilities
Skill Enumeration
Medium
- Category
- Agent Snooping
- Confidence
- 80% confidence
- Finding
This path disclosure leaks another internal support module and contributes to overall repository and capability enumeration. The surrounding skill context involves runtime lifecycle and process control, so even low-grade information disclosure is somewhat more relevant because it helps an adversary understand how operational changes are governed.
- Content
md - `dev/ai/skills/weline-framework-runtime/SKILL.md` - `dev/ai/skills/runtime-and-process/SKILL.md` - `dev/ai/skills/windows-command-quoting/SKILL.md` - `dev/ai/skills/code-generation-standards/SKILL.md` # Responsibilities
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 82% confidence
- Finding
This markdown file contains user-facing natural language in mixed locales, with the title in Chinese and the description/instructions in English. Because the skill does not explain a required locale or offer an opt-in language choice, it may violate a language/locale policy requiring consistent or user-selected language behavior.
- Content