Tp2
High
- Category
- MCP Tool Poisoning
- Confidence
- 85% confidence
- Finding
Mixing characters from multiple Unicode scripts in a single identifier is a common technique to create visually ambiguous tool names.
- Content
Security audit
PPAP技能助手
Security checks for vulnerabilities and agentic risk
Overview
This PPAP assistant is a coherent Chinese-language quality-documentation skill with a simple local checker script and no evidence of hidden, persistent, destructive, or exfiltrating behavior.
Install this if you want a Chinese-language PPAP documentation helper. Only run the checker on PPAP JSON files you intend to provide, and review any generated templates or reports against your customer-specific requirements before using them formally.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Vulnerability Patterns
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (6)
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 87% confidence
- Finding
The skill references local files and a Python script for checking PPAP inputs, which implies file read capabilities and potentially file output/report generation, but it does not declare any explicit tool scope or permissions. This creates an authorization ambiguity where an agent may access files more broadly than intended, increasing the risk of unintended data exposure or misuse when handling user-supplied paths or documents.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The trigger conditions include broad terms like PPAP, submission warrant, part approval, and IATF16949, which may match loosely related quality-management conversations. Over-broad activation can cause the wrong skill to engage, leading to unnecessary file access, inappropriate guidance, or processing of unrelated user documents under this skill's workflow.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The title and entire guidance are written exclusively in Chinese, and the file provides no indication that users may choose another language or that the language restriction is required for a region-specific or compliance-specific purpose. Under the policy, forcing a specific language without opt-in is a natural-language policy violation.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 86% confidence
- Finding
This markdown file contains user-facing instructional content only in Chinese, with no indication that users may choose another language or that the skill is explicitly scoped to Chinese-speaking users. Under the policy rule for language/locale constraints, forcing a specific language without opt-in can be a natural-language policy violation.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
This code file contains user-facing natural-language descriptions and output messages in Chinese only, starting with the module docstring and continuing throughout the CLI. Under the policy rule for language/locale, forcing a single language without user opt-in can be a natural-language policy violation unless clearly justified as region-specific.
- Content
Static analysis
No suspicious patterns detected.