Tp2
High
- Category
- MCP Tool Poisoning
- Confidence
- 85% confidence
- Finding
Mixing characters from multiple Unicode scripts in a single identifier is a common technique to create visually ambiguous tool names.
- Content
Security audit
QMS环境因素技能
Security checks for vulnerabilities and agentic risk
Overview
This skill is a Chinese-language QMS analysis helper that reads user-provided JSON and generates local charts and PDF reports without hidden network, credential, persistence, or destructive behavior.
Installers should expect this skill to run a local Python script and create charts/PDF files in the chosen output directory. Review the Chinese templates for fit with your organization and avoid placing confidential business data in shared output locations.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Vulnerability Patterns
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (5)
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 70% confidence
- Finding
Without declared permissions the skill's intent is opaque and cannot be validated.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
This markdown template forces a specific language/locale for all users by presenting all headings, instructions, field explanations, and examples only in Chinese. Under the stated policy, language constraints should either offer user choice or be explicitly documented as justified for a region-specific use case.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
This code hard-codes Chinese-language descriptions, chart labels, report text, and Chinese font selection, making the skill operate in a specific language/locale by default. The file does not provide any user opt-in, language switch, or documented region-specific justification for this constraint.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The TRACE section includes the natural-language claim "支持中文交互", which indicates a language constraint/preference but does not mention user choice or opt-in. Under the policy rule, forcing or presuming a specific language without explicit choice can be a locale/language policy issue.
- Content
Static analysis
No suspicious patterns detected.