Tp2
High
- Category
- MCP Tool Poisoning
- Confidence
- 85% confidence
- Finding
Mixing characters from multiple Unicode scripts in a single identifier is a common technique to create visually ambiguous tool names.
- Content
Security audit
query-rewrite
Security checks for vulnerabilities and agentic risk
Overview
This is a query-rewriting guide for RAG searches, with no executable code, persistence, credential handling, or hidden install behavior found.
Install this if you want Chinese-oriented RAG query rewriting before memory or wiki searches. Be aware that broad triggers may cause extra rewritten searches, so review behavior if you discuss query rewriting concepts rather than intending to run it.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Vulnerability Patterns
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (9)
Tp2
High
- Category
- MCP Tool Poisoning
- Confidence
- 85% confidence
- Finding
Mixing characters from multiple Unicode scripts in a single identifier is a common technique to create visually ambiguous tool names.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The trigger phrase '检索增强' is broad enough to match ordinary discussion about RAG or retrieval tuning, which can cause unintended activation of this skill in contexts where the user did not request query rewriting. Accidental activation can alter the agent's workflow, introduce unnecessary search fan-out, and increase the chance of context drift or retrieval of irrelevant/sensitive material.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The standalone trigger '指代消解' is a generic NLP concept and may appear in normal conversation, analysis requests, or educational contexts without meaning 'run this skill now'. That ambiguity raises the risk of spurious invocation, which is especially relevant here because the skill may expand or rewrite queries automatically before search.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
The phrase '多意图拆解' is too generic to uniquely signal invocation of this skill and could appear in unrelated prompt-engineering or product discussions. If auto-triggered, the skill could split user input into multiple searches, increasing tool usage and potentially broadening data exposure beyond the user's intended narrow request.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
This markdown file is written entirely in Chinese and presents the skill behavior and rewrite patterns as fixed instructions, with no indication that users may choose another language or locale. Under the policy rule for natural-language violations, a skill that imposes a specific language without opt-in should be flagged unless the locale restriction is documented and justified.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 71% confidence
- Finding
The natural-language content is predominantly Chinese, while only a brief English summary is provided. This may amount to an implicit language preference without an explicit opt-in or statement that users may interact in their preferred language.
- Content
Vague Triggers
Low
- Category
- Not specified by scanner
- Confidence
- 80% confidence
- Finding
The trigger '反问改写' is somewhat underspecified and may activate on discussion of rhetoric or writing rather than a concrete request to rewrite a query for retrieval. The resulting risk is lower than broader triggers, but unintended rewrites can still distort workflow and cause unnecessary retrieval operations.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 87% confidence
- Finding
This manifest file includes user-facing natural-language content in Chinese in the changes list, with no indication that the skill is intended only for Chinese-speaking users or that alternate language support is available. That can violate language/locale policy expectations when a skill implicitly forces a specific language without user opt-in.
- Content
Static analysis
No suspicious patterns detected.