Tp2
High
- Category
- MCP Tool Poisoning
- Confidence
- 85% confidence
- Finding
Mixing characters from multiple Unicode scripts in a single identifier is a common technique to create visually ambiguous tool names.
- Content
Security audit
Base Station / Cell Query - 基站查询
Security checks for vulnerabilities and agentic risk
Overview
This is a straightforward cell-tower lookup skill, but its queries can reveal approximate location and are sent to JisuAPI with the configured API key.
Install only if you are comfortable sending base-station identifiers and your JisuAPI key to JisuAPI for lookup. Treat these queries as location-sensitive, use the skill only for explicit user requests, and avoid looking up another person's location-related data without proper authorization.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (6)
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The skill processes cell-tower identifiers that can be used to infer approximate location, yet the documentation does not warn that these inputs are sensitive or that they will be transmitted to a third-party API provider. In a location-query context, this omission materially increases privacy risk because users or agents may disclose telecom-derived location data without informed consent.
- Content
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 91% confidence
- Finding
The skill requires an environment secret (JISU_API_KEY) and performs network-backed lookups, but it does not declare explicit tool scope such as permissions or allowed-tools. That creates a governance gap: an agent may invoke code with broader-than-expected capabilities or without clear operator review, increasing the risk of unintended external data transmission and secret use.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The trigger description includes broad phrasing like '或类似基站定位问题时，使用本技能', which can cause the agent to invoke the skill for loosely related prompts. Because this skill sends telecom cell parameters to a third-party service to derive location, accidental invocation can disclose sensitive location-related data without sufficiently clear user intent.
- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 60% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
python import requests CELL_QUERY_URL = "https://api.jisuapi.com/cell/query" def query_cell(appkey: str, req: dict):
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
This code performs a network call to a third-party API and includes both the API key and user-provided cell identifiers in the request parameters. Although the module docstring names the API provider, there is no runtime warning, confirmation, or user-facing notice before transmitting the data.
- Content
Static analysis
No suspicious patterns detected.