Tp2
High
- Category
- MCP Tool Poisoning
- Confidence
- 85% confidence
- Finding
Mixing characters from multiple Unicode scripts in a single identifier is a common technique to create visually ambiguous tool names.
- Content
Security audit
Ohmy Skill
Security checks for vulnerabilities and agentic risk
Overview
This is a small, disclosed meta-skill for checking and recommending ClawHub skills, with no bundled code, secrets, persistence, or hidden execution behavior.
Installers should be aware that this skill is written primarily in Chinese and has broad activation phrases, so they may want to invoke it with explicit "ohmy skill ..." wording. The artifact itself does not show hidden execution, credential access, persistence, or destructive behavior.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Vulnerability Patterns
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (10)
Tp2
High
- Category
- MCP Tool Poisoning
- Confidence
- 85% confidence
- Finding
Mixing characters from multiple Unicode scripts in a single identifier is a common technique to create visually ambiguous tool names.
- Content
Tp2
High
- Category
- MCP Tool Poisoning
- Confidence
- 85% confidence
- Finding
Mixing characters from multiple Unicode scripts in a single identifier is a common technique to create visually ambiguous tool names.
- Content
Tp2
High
- Category
- MCP Tool Poisoning
- Confidence
- 85% confidence
- Finding
Mixing characters from multiple Unicode scripts in a single identifier is a common technique to create visually ambiguous tool names.
- Content
Tp2
High
- Category
- MCP Tool Poisoning
- Confidence
- 85% confidence
- Finding
Mixing characters from multiple Unicode scripts in a single identifier is a common technique to create visually ambiguous tool names.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
This markdown file explicitly mentions optimized trigger words including phrases like "技能排名" and especially "推荐 skill", but provides no activation boundaries, exclusions, or negative examples. "推荐 skill" is broad enough to overlap with ordinary conversation about recommendations, which could lead to unintended invocation if used as a trigger.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The trigger list is unusually broad and includes generic phrases like "ohmy", "zskill", and recommendation/ranking terms without clear scoping or exclusion conditions. This can cause unintended activation in unrelated conversations, increasing the chance the skill runs on contexts the user did not explicitly intend, which is a real security and safety concern for an auditing/optimization skill that may inspect or transform other skills.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The trigger set includes broad terms such as 'ohmy', '排行榜', and '推荐技能', which can plausibly appear in ordinary conversation and unintentionally invoke the skill. Because this is a meta-skill that can inspect, optimize, rank, and recommend other skills, accidental activation could expose user context to unintended processing or cause the assistant to take the conversation down an unexpected tool path.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 74% confidence
- Finding
The changelog describes functionality and trigger wording entirely in Chinese, including the added trigger phrases, without stating that language selection is optional or that the skill is intentionally region-specific. This can indicate a language-policy issue if the skill forces a specific language or locale without user opt-in.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The skill description and usage instructions are written in Chinese, which can imply a fixed language experience without offering user opt-in or clarifying that the skill is intended for a Chinese-speaking audience. This may violate language/locale policy if users are expected to have a choice of language.
- Content