Tp2
High
- Category
- MCP Tool Poisoning
- Confidence
- 85% confidence
- Finding
Mixing characters from multiple Unicode scripts in a single identifier is a common technique to create visually ambiguous tool names.
- Content
Security audit
欧盟REACH法规专家
Security checks for vulnerabilities and agentic risk
Overview
The skill is not malicious, but it needs review because its REACH compliance advice depends on a referenced knowledge base that is missing and it steers users away from current official EU sources.
Install only if you want a Chinese-language, offline-style REACH reference prompt and are prepared to verify all compliance decisions against current authoritative sources or qualified counsel. Do not rely on it for latest SVHC status, filings, market-access decisions, or legal obligations unless the missing knowledge-base files are supplied and the content is updated.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Vulnerability Patterns
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (5)
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The instruction states that all responses should prioritize Chinese, which imposes a language preference rather than offering the user a choice. Under the policy, forcing a specific language without opt-in is a natural-language policy violation.
- Content
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The exception-handling section introduces Python dependency checks, system tool installation guidance, and PNG/SVG fallback behavior that are unrelated to a text-only REACH compliance skill. This kind of capability mismatch can mislead an agent into attempting unnecessary local environment inspection or tool-oriented actions, expanding behavior beyond the declared scope and increasing the risk of unsafe execution paths.
- Content
Vague Triggers
Low
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The trigger says to use the skill whenever users ask about REACH regulations, SVHC substances, chemical compliance, registration processes, and similar topics, but it does not define exclusions or negative examples. This broad phrasing can cause unintended invocation for general chemistry or compliance discussions that only partially relate to the skill.
- Content
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 81% confidence
- Finding
The skill provides regulatory compliance guidance from a local Chinese knowledge base while discouraging direct use of official EU sources, yet it lacks a strong upfront disclaimer that the content may be incomplete, outdated, and not a substitute for formal legal or regulatory advice. In a compliance context, users may over-rely on the output for filing, market access, or SVHC obligations, leading to real-world legal and business harm.
- Content