Tp2
High
- Category
- MCP Tool Poisoning
- Confidence
- 85% confidence
- Finding
- Mixing characters from multiple Unicode scripts in a single identifier is a common technique to create visually ambiguous tool names.
Security audit
狐表(Foxtable) 开发文档
Security checks across malware telemetry and agentic risk
Overview
This is a Foxtable development documentation skill, and the flagged behavior appears to be a bilingual title rather than a hidden or dangerous capability.
Install this if you want Codex to reference Foxtable development documentation. The docs contain examples involving credentials, FTP, email, uploads/downloads, remote update behavior, and deletion, so review any generated Foxtable code carefully before running it against real files, accounts, or business data.
SkillSpector
By NVIDIA
Vulnerability Patterns
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (1)
VirusTotal
64/64 vendors flagged this skill as clean.
Static analysis
No suspicious patterns detected.