Tp2
High
- Category
- MCP Tool Poisoning
- Confidence
- 85% confidence
- Finding
Mixing characters from multiple Unicode scripts in a single identifier is a common technique to create visually ambiguous tool names.
- Content
Security audit
Paper Decompose
Security checks for vulnerabilities and agentic risk
Overview
This skill is a disclosed document-analysis template with some financial-output caveats but no hidden code, persistence, or privileged behavior.
Install only if you want a Chinese-oriented paper/report decomposition workflow. For investment-report use, treat any suggested action such as add, hold, reduce, or watch as non-personal research commentary and make financial decisions through your own review or a qualified advisor.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Vulnerability Patterns
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (8)
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The trigger rules include broad everyday phrases such as '读 arXiv', '看这篇论文', and especially '帮我看看' when paired with a link/PDF/text, which can cause the skill to activate in situations where the user did not explicitly request this analysis mode. Over-broad activation increases the chance of unintended routing, unexpected downstream processing, and accidental invocation of the investment-analysis behavior described later in the skill.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The skill introduces '投资影响评估' and outputs position recommendations like '加仓 / 持有 / 减仓 / 观望' without a visible user warning, consent step, or disclaimer in the main description/output contract. In context, this can mislead users into treating a document-analysis skill as investment advice and may trigger downstream decision workflows without adequate notice or risk framing.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The heading explicitly labels this as an output template in Chinese, which signals a fixed language requirement. Because the file does not offer an alternative language option or state that Chinese is optional, it creates a language-policy concern under the locale/language choice rule.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 78% confidence
- Finding
The mode field includes '中文研报' and otherwise defines document types, but the broader template remains Chinese-only and does not tell the user they may choose another output language. This can be read as forcing a specific language/locale rather than offering a user-selected format.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The markdown explicitly sets the mode to "en-paper" and labels the input as an English-paper workflow, which imposes a language/locale constraint in the skill behavior. The file does not indicate that users can choose another language mode or that this English-only constraint is required for a clearly documented region- or compliance-specific reason.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The sample output expands the skill from paper/report decomposition into investment-impact evaluation, which is outside the stated skill purpose. This creates scope creep that can cause the agent to produce financial analysis or suggestions without explicit user consent, policy gating, or a manifest-level declaration, increasing the risk of inappropriate or non-compliant advice.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The acceptance criteria institutionalize investment-impact assessment as part of successful skill behavior even though the manifest describes only four-layer paper/report decomposition. This misalignment can train operators or downstream evaluators to expect unauthorized finance-related output, making the overreach systematic rather than incidental.
- Content