Tp2
High
- Category
- MCP Tool Poisoning
- Confidence
- 85% confidence
- Finding
Mixing characters from multiple Unicode scripts in a single identifier is a common technique to create visually ambiguous tool names.
- Content
Security audit
去AI味 Humanizer
Security checks for vulnerabilities and agentic risk
Overview
This is a coherent text-editing skill with no hidden code or persistence, but its broad triggers and file-edit permissions mean users should review edits before accepting them.
This skill is reasonable to install for prose editing. Use it with clearly specified text or file paths, and review diffs before accepting file changes because generic polish or humanize requests may invoke it.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Vulnerability Patterns
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (10)
Tp2
High
- Category
- MCP Tool Poisoning
- Confidence
- 85% confidence
- Finding
Mixing characters from multiple Unicode scripts in a single identifier is a common technique to create visually ambiguous tool names.
- Content
Tp2
High
- Category
- MCP Tool Poisoning
- Confidence
- 85% confidence
- Finding
Mixing characters from multiple Unicode scripts in a single identifier is a common technique to create visually ambiguous tool names.
- Content
Tp2
High
- Category
- MCP Tool Poisoning
- Confidence
- 85% confidence
- Finding
Mixing characters from multiple Unicode scripts in a single identifier is a common technique to create visually ambiguous tool names.
- Content
Tp2
High
- Category
- MCP Tool Poisoning
- Confidence
- 85% confidence
- Finding
Mixing characters from multiple Unicode scripts in a single identifier is a common technique to create visually ambiguous tool names.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
A broad trigger can cause the skill to activate on generic editing requests and take over tasks the user did not intend for it. Because the skill is allowed to use Write and Edit tools, accidental invocation can lead to unsolicited content modification, including changes to files the user expected to remain untouched.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The English trigger overlaps with common writing-assistance requests, increasing the chance of unintended activation during ordinary conversations. In a public skill with file-modification capabilities, that can produce surprising edits, workflow interference, or accidental rewriting of sensitive drafts.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 79% confidence
- Finding
The README states the skill is "Chinese-specific" and highlights handling of Chinese punctuation, slang, and style conventions. This can indicate a language/locale preference baked into the skill behavior, but the document does not clearly state that users can opt into or out of this locale-specific mode beyond example phrasing.
- Content
Overly Broad Trigger
Low
- Category
- Trigger Abuse
- Confidence
- 89% confidence
- Finding
The trigger '润色' is extremely short and common, so it is likely to match many benign requests for polishing text that were not meant to invoke this specific skill. Given the skill's editing powers, this creates a realistic risk of unintended activation and unauthorized-seeming modifications within broader workflows.
- Content
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 79% confidence
- Finding
The skill advertises Write/Edit capability without clearly warning users that it may modify files. This raises the risk of user surprise and unintended data changes, especially when combined with broad triggers and a public visibility setting.
- Content