Tp2
High
- Category
- MCP Tool Poisoning
- Confidence
- 85% confidence
- Finding
Mixing characters from multiple Unicode scripts in a single identifier is a common technique to create visually ambiguous tool names.
- Content
Security audit
Destiny Weaver
Security checks for vulnerabilities and agentic risk
Overview
This is a disclosed Markdown-based storytelling game skill that saves game/story files and can generate images, with no evidence of hidden execution, credential access, exfiltration, or destructive behavior.
Install only if you are comfortable with a Chinese-first storytelling game that writes save files, story archives, and generated images locally. Avoid entering sensitive personal details into the story if you do not want them retained in saves or used in image prompts, and use clear game-specific phrasing to avoid accidental commands.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (24)
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The activation phrases include very generic natural-language commands like “开始新游戏”, which can plausibly appear in ordinary conversation or in unrelated user context. In an agent environment, broad triggers increase the risk of accidental skill activation or unintended state changes without clear user intent verification.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The command set contains short, ambiguous triggers such as “继续”, “状态”, and “故事”, which are common words that may occur in regular dialogue. Without context gating, these commands could be misinterpreted by the host agent as control instructions, causing unintended progression, disclosure of in-session data, or save operations.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The README advertises very generic activation phrases like "Continue", "Status", and "Open the Codex", which can easily collide with ordinary conversation in a chat environment. In an agent skill context, broad triggers can cause accidental invocation of game actions, unintended state changes, or unexpected disclosure of in-game data when the user did not mean to operate the skill.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The README advertises character and scene image generation without warning that narrative details, character attributes, or user-provided preferences may be sent to an image-generation subsystem or external service. In this skill, generated content is derived from gameplay history and can include sensitive or revealing details, so undisclosed prompt sharing creates a privacy and transparency issue.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The command table includes many vague one-word or short triggers such as "Start", "Story", "World", "Relations", and "Save", which are likely to overlap with normal user dialogue. In a conversational agent, this increases the chance of accidental command execution, including unintended saves, loads, world reveals, or progression of gameplay state.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The README states that the system supports auto-save every turn and story archives, but does not warn users that gameplay content may be persistently stored. Because this game can collect freeform choices, relationships, and generated life history over time, silent persistence creates a privacy and data-retention risk if users do not realize their interactions are being kept.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The trigger phrases include broad generic terms such as '异世界游戏', '人生模拟', '回合制', '文字冒险', and '角色扮演', which can cause the skill to activate in unrelated conversations about games or storytelling. Because the skill has Write and ImageGeneration permissions, accidental invocation could lead to unintended file creation, state persistence, or image outputs without clear user intent.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The skill declares persistent storage paths under stories/[剧本名]/ and also supports image generation, but the description and UX do not clearly warn users that gameplay will write files and create generated media artifacts. This can surprise users, especially when combined with broad triggers, and may result in retention of story content or images they did not expect to persist.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The manual trigger phrases are broad natural-language patterns like '生成场景', '画一张[描述]', and '我想看看[某人/某地]', which can easily match ordinary gameplay conversation rather than an explicit image-generation command. In an agentic skill, this can cause unintended tool invocation, surprise content generation, excess cost, or generation based on attacker-influenced text without a clear confirmation boundary.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
This markdown prompt prescribes all story-generation structure and examples in Chinese, with no indication that users may choose another language. Under the stated policy, forcing a specific language without user opt-in is a natural-language policy violation unless the locale constraint is explicitly documented and justified.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
SQP-3 applies to all file types and covers natural-language policy violations such as forcing a specific language without user opt-in. This file contains all user-facing instructions in Chinese and does not indicate that the skill is region-specific or that users may choose another language.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The choice-event trigger treats nearly any player utterance as an action trigger, including the rule '玩家提出任何行动'. In an LLM-driven skill, this can cause over-capture of user input, misclassify out-of-band instructions or safety-relevant messages as in-game actions, and make prompt/flow control easier to subvert.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The title "输出格式规范" and the entire template prescribe response structure exclusively in Chinese. This is a natural-language locale constraint, and the file does not indicate user opt-in, language selection, or a documented region-specific justification.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The document is entirely written in Chinese and presents all user-facing commands and templates in Chinese only, with no indication that other languages are supported or that the locale restriction is optional. Under the policy, language-specific behavior should either offer user choice or clearly justify the restriction.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
This markdown skill specifies all instructions and examples in Chinese, and does not indicate that the user can choose another language or that the skill is intentionally limited to a Chinese-language audience. Under the policy for natural-language violations, forcing a specific language without user opt-in should be flagged.
- Content
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 84% confidence
- Finding
The README advertises save, load, story storage, and export capabilities but does not warn users that character names, story content, and generated outputs may be persisted to disk. In a storytelling skill, users may input personal or sensitive material, so undisclosed retention can create privacy and data handling risks even if no overt exfiltration is described.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
This markdown template is entirely written in Chinese and presents a fixed-language format for the skill artifact. Under the policy for natural-language violations, forcing a specific language without user opt-in can be a locale-policy issue when no alternative or choice is documented.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
This markdown template is entirely written in Chinese and presents the skill's output structure in that language, with no indication that users can choose another language. Under the policy, forcing a specific language without user opt-in is a natural-language policy concern.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
This JSON save data uses Chinese-language values throughout, but provides no natural-language indication that the skill or its outputs are language-selectable or intentionally region-specific. Under the policy, forcing a specific language without user opt-in can be a locale/language policy issue.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
This JSON template includes a user-facing string in Chinese ("初始化模板") as a fixed value. Because the file provides no indication that the locale is configurable or intentionally region-specific, it may violate language-choice policy by forcing a specific language without user opt-in.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The template sets default user-facing state values such as "婴儿期" and "平静" directly in Chinese. Since there is no accompanying locale selection or documentation justifying a Chinese-only experience, these defaults may impose a language choice on users.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 82% confidence
- Finding
This JSON content is entirely authored in Chinese and encodes the story/world labels, character descriptors, and location names in a single language with no indication that users may select another language or locale. Under the stated policy, forcing a specific language without user opt-in can be a natural-language policy violation even in config or data files.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
This markdown file presents all user-facing narrative and continuation instructions exclusively in Chinese, including the invocation-style prompt at L451 ('说"下一回合"继续...'). Under the policy, forcing a specific language without user opt-in is a natural-language policy violation unless a locale constraint is explicitly documented and justified, which is not present here.
- Content
Static analysis
No suspicious patterns detected.