Tp2
High
- Category
- MCP Tool Poisoning
- Confidence
- 85% confidence
- Finding
Mixing characters from multiple Unicode scripts in a single identifier is a common technique to create visually ambiguous tool names.
- Content
Security audit
workbuddy-skill-assistant
Security checks for vulnerabilities and agentic risk
Overview
The skill is mostly a disclosed WorkBuddy skill-management assistant, but it includes broad local diagnostics and an out-of-scope investment workflow that users should review before installing.
Install only if you want a WorkBuddy assistant that can inspect local WorkBuddy state and help manage skills, automations, connectors, and reports. Review or remove the investment morning-briefing workflow and private-note/contact sync templates before use, and require explicit confirmation for installs, upgrades, automation creation, memory writes, connector changes, and any financial-analysis workflow.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Vulnerability Patterns
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (94)
Tp2
High
- Category
- MCP Tool Poisoning
- Confidence
- 85% confidence
- Finding
Mixing characters from multiple Unicode scripts in a single identifier is a common technique to create visually ambiguous tool names.
- Content
Tp2
High
- Category
- MCP Tool Poisoning
- Confidence
- 85% confidence
- Finding
Mixing characters from multiple Unicode scripts in a single identifier is a common technique to create visually ambiguous tool names.
- Content
Tp2
High
- Category
- MCP Tool Poisoning
- Confidence
- 85% confidence
- Finding
Mixing characters from multiple Unicode scripts in a single identifier is a common technique to create visually ambiguous tool names.
- Content
Tp2
High
- Category
- MCP Tool Poisoning
- Confidence
- 85% confidence
- Finding
Mixing characters from multiple Unicode scripts in a single identifier is a common technique to create visually ambiguous tool names.
- Content
Tp2
High
- Category
- MCP Tool Poisoning
- Confidence
- 85% confidence
- Finding
Mixing characters from multiple Unicode scripts in a single identifier is a common technique to create visually ambiguous tool names.
- Content
Tp2
High
- Category
- MCP Tool Poisoning
- Confidence
- 85% confidence
- Finding
Mixing characters from multiple Unicode scripts in a single identifier is a common technique to create visually ambiguous tool names.
- Content
Tp2
High
- Category
- MCP Tool Poisoning
- Confidence
- 85% confidence
- Finding
Mixing characters from multiple Unicode scripts in a single identifier is a common technique to create visually ambiguous tool names.
- Content
Tp2
High
- Category
- MCP Tool Poisoning
- Confidence
- 85% confidence
- Finding
Mixing characters from multiple Unicode scripts in a single identifier is a common technique to create visually ambiguous tool names.
- Content
Tp2
High
- Category
- MCP Tool Poisoning
- Confidence
- 85% confidence
- Finding
Mixing characters from multiple Unicode scripts in a single identifier is a common technique to create visually ambiguous tool names.
- Content
Tp2
High
- Category
- MCP Tool Poisoning
- Confidence
- 85% confidence
- Finding
Mixing characters from multiple Unicode scripts in a single identifier is a common technique to create visually ambiguous tool names.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
声明描述的是面向最终用户的“skill 使用助理/管理指南”能力，重点在于选择、安装、调用、组合、维护、整理 skills，以及从 SkillsHub 检索并适配到 WorkBuddy。给出的代码却只是一个底层辅助脚本：接收命令行参数，调用 subprocess.run 执行外部命令，在失败时按 backoff 重试，并返回 0/2/3 等退出码。它没有实现任何与 skill 管理指南直接对应的核心功能，也没有体现描述中的触发场景、分类体系、工作流卡片、注册表管理或经验沉淀。虽然它可能是某个更大系统中的支撑组件，但就所提供代码块本身而言，其主要行为与声明用途存在明显偏离。
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
The declared description portrays a broad user-facing assistant for managing WorkBuddy skills: recommending skills, organizing them, combining them into workflows, troubleshooting when skills do not trigger, and integrating external sources like SkillsHub. The actual code chunk does none of that. It only implements a single internal helper for retrieving a version string from SKILL.md or manifest.json. While version handling could be a supporting implementation detail within a larger skill, this code chunk itself does not reflect the declared primary purpose and instead serves an unrelated packaging/metadata function. Therefore this is a clear description-versus-behavior mismatch.
- Content
Vague Triggers
High
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The trigger phrases include very generic language such as '检查一下', '诊断', and similar everyday expressions that could be said in unrelated conversations. Overly broad activation language raises the risk of accidental invocation of a skill that scans system state or proposes operational changes, especially in a conversational assistant that routes by natural-language matching.
- Content
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The contact-management entry advertises importing business cards, WeChat, and CSV data into structured notes without flagging that this is personal data processing. Because the file is a recommendation catalog for operational use, the lack of sensitivity warning can lead to unsafe handling of PII, cross-linking of identities, and retention of regulated contact data in local knowledge stores.
- Content
Description-Behavior Mismatch
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
This workflow performs substantive financial analysis and produces an end-to-end market briefing and portfolio decision support, which is materially outside the manifest's stated scope of helping users choose, install, and organize skills. Scope drift like this is dangerous because it can cause the agent to take on sensitive, high-impact advisory behavior that users and platform controls would not expect from this skill.
- Content
Context-Inappropriate Capability
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
The workflow generates specific trading advice for named holdings, including position sizing, add/reduce conditions, and trigger prices. Personalized investment recommendations are high-risk because they can directly influence real financial decisions, and here they are embedded in a skill not represented as a finance-advice tool, making the mismatch especially dangerous.
- Content
Lp1
High
- Category
- MCP Least Privilege
- Confidence
- 92% confidence
- Finding
This file provides shell/process-execution capability, but the finding indicates that capability is not declared in the skill's permissions model. Undeclared execution capability weakens review and containment because users and the platform may not realize the skill can launch external commands, increasing the chance of unsafe installation or misuse.
- Content
Lp1
High
- Category
- MCP Least Privilege
- Confidence
- 75% confidence
- Finding
The skill uses 'network' capability that is not listed in its permissions. This may indicate deceptive intent or missing permission declarations.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The display name and the entire user-facing instruction set are presented in Chinese, and the file gives no indication that users may choose another language. This creates a locale/language constraint without documented opt-in or justification for a region-specific audience.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
The trigger set includes broad, generic phrases such as '使用助理' and similar high-overlap wording that can unintentionally activate this skill for unrelated requests. In an agent environment with tool access, overly broad activation increases the chance of accidental context capture, inappropriate recommendations, or unintended file/tool operations under the wrong skill.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 86% confidence
- Finding
The positioning statement says the skill does not do "skill创建及开发、升级等", suggesting a narrower advisory-only role. Elsewhere, the document explicitly instructs installation, maintenance, writing back workflow/interface revisions, and discussing external installation flows, which goes beyond that stated limitation and creates a semantic mismatch about the skill's operational scope.
- Content
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
Line L025 states the skill does not do "升级等". However, L085 and L102 explicitly treat upgrade operations as possible write actions that may proceed after user confirmation, which directly contradicts the earlier statement rather than merely omitting detail.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
This markdown file presents the entire checklist and operational guidance only in Chinese, with no indication that users may choose another language or opt in to this locale. Under the policy for natural-language violations, forcing a specific language without user choice is reportable unless the locale constraint is explicitly justified.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The knowledge-base sync template instructs automated scanning of recent Obsidian notes and ingestion into a knowledge graph, but it provides no privacy warning, consent checkpoint, scope restriction, or data classification guidance. In a skill-management assistant, this is risky because personal notes often contain sensitive information, and the automation normalizes background collection and secondary use of user content without explicit acknowledgment.
- Content