Tp2
High
- Category
- MCP Tool Poisoning
- Confidence
- 85% confidence
- Finding
Mixing characters from multiple Unicode scripts in a single identifier is a common technique to create visually ambiguous tool names.
- Content
Security audit
Essence Trace
Security checks for vulnerabilities and agentic risk
Overview
This is a markdown-only Chinese reasoning skill for root-cause analysis, with no code execution or data access, though its broad trigger wording and investment-oriented branch deserve user attention.
Install this if you want a Chinese root-cause analysis framework. Be aware that common why-questions may trigger it more often than intended, and investment-related outputs should be reviewed as general reasoning only, not financial advice. I found no evidence that it runs code, accesses private data, installs persistence, or changes the environment.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Vulnerability Patterns
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (6)
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 82% confidence
- Finding
文件全文以中文规定处理流程、输出格式和固定措辞，未说明可根据用户语言偏好切换，也未提供用户可选语言的说明。若该技能面向通用用户，这种默认强制单一语言的自然语言约束可能构成未获用户选择的 locale 政策问题。
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The investment-specific branch can be activated by the vague condition '问题为投资类' without a precise classifier, consent step, or scoped trigger. That can cause the skill to drift from generic root-cause analysis into investment-oriented reasoning and downstream strategy suggestions for queries that merely mention markets or prices, increasing the risk of unintended financial guidance.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
Including the everyday word “为什么” (“why”) as a trigger makes the skill eligible to activate during ordinary conversation, not just explicit invocation. That can cause unintended routing, override more appropriate skills, or make the agent apply this reasoning pattern in contexts where the user did not request it, reducing predictability and increasing prompt-surface exposure.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The activation examples are broad enough to match common user utterances like asking why something is the case, which creates ambiguous skill selection and accidental invocation. In an agent system, overly permissive trigger scope can be exploited indirectly by shaping ordinary conversation to force this skill path, causing misrouting or bypass of more suitable safeguards/workflows.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 79% confidence
- Finding
The entire skill content is presented only in Chinese and is framed specifically around a China-focused housing example, with no indication that users may choose another language or locale. Under the policy rule, forcing a specific language without opt-in can be a natural-language policy concern.
- Content