Tp2
High
- Category
- MCP Tool Poisoning
- Confidence
- 85% confidence
- Finding
Mixing characters from multiple Unicode scripts in a single identifier is a common technique to create visually ambiguous tool names.
- Content
Security audit
Skill开发
Security checks for vulnerabilities and agentic risk
Overview
This skill is a coherent skill-authoring helper with disclosed file-generation behavior and no hidden code, credential use, or destructive instructions found.
Before installing, be aware that this skill is designed to create local skill files and may use a connected code-hosting service to create a PR. Confirm output paths, avoid overwriting existing work, and review generated trigger descriptions for overly broad activation wording.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Vulnerability Patterns
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (8)
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
The skill instructs authors to define trigger phrases based on broad user wording without requiring narrow activation criteria, exclusions, or conflict avoidance. This can cause overbroad invocation, where the skill activates on unrelated conversations and performs unintended actions such as generating files or steering workflow in contexts the user did not mean to invoke it.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The guidance for the description field emphasizes including trigger keywords to help automatic invocation, but it does not warn against common-language collisions or require specificity. In a skill-generation context, this increases the chance that downstream skills built from this template will advertise broad trigger terms and be auto-invoked unexpectedly across normal user requests.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The skill states that if no connectors are available, output should go to the local filesystem by default, without requiring explicit user consent, path restrictions, or a dry-run confirmation. In an agent environment, default file-writing behavior can lead to unintended persistence, overwriting local files, or creating artifacts in sensitive directories when the user only expected advisory text.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
Line L08 requires
description_zhto be filled, and the file itself is written entirely in Chinese, indicating a language-specific requirement. The document does not present this as optional, user-selected, or justified for a region-specific use case, which can conflict with language/locale policy expectations.- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
The template explicitly requires an English description and a Chinese description, which imposes specific language requirements on skill authors. Because the file does not present this as optional, user-selectable, or region-specific, it can be read as a locale policy constraint without opt-in.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
This section repeats the requirement for both English and Chinese descriptions, again hard-coding language expectations into the template. The file does not indicate that authors may choose other languages or that the bilingual requirement is limited to a specific locale or compliance need.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
The knowledge-base template continues the same fixed bilingual pattern, which constitutes a natural-language policy concern when no language choice or justification is provided. This can unnecessarily force a specific locale standard across all skills.
- Content
Static analysis
No suspicious patterns detected.