Tp2
High
- Category
- MCP Tool Poisoning
- Confidence
- 85% confidence
- Finding
Mixing characters from multiple Unicode scripts in a single identifier is a common technique to create visually ambiguous tool names.
- Content
Security audit
Cn Stock Brief
Security checks for vulnerabilities and agentic risk
Overview
This skill coherently fetches public A-share market data from Eastmoney and prints a Chinese stock-market brief without persistence, credential access, or local data collection.
Install this if you are comfortable with the skill making live requests to Eastmoney for public market data and producing Chinese-language output. Treat the report as informational only, as the skill itself notes it is not investment advice.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (5)
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 84% confidence
- Finding
The skill appears to perform live network access to a third-party market data source, but the manifest does not declare any tool scope or permission boundary. This weakens reviewability and can cause an agent or user to invoke network-capable behavior without explicit disclosure or least-privilege constraints.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The skill name, instructions, usage notes, and examples are entirely in Chinese, which imposes a specific language/locale on users without any opt-in or stated regional constraint. The policy specifically calls for flagging language or locale constraints when the skill forces a specific language without user choice.
- Content
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 87% confidence
- Finding
The documentation references an external data source, but it does not clearly warn users that running the skill triggers live requests to a third-party service. This can create privacy, compliance, or reliability surprises in environments where outbound traffic must be explicitly disclosed and approved.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The file’s user-facing docstrings and printed output are written entirely in Chinese, including the main status and report text. Because the skill does not provide any user opt-in, localization setting, or explanation that it is intentionally region/language-specific, it can violate a language/locale policy requiring user choice or documented justification.
- Content
Static analysis
No suspicious patterns detected.