Tp2
High
- Category
- MCP Tool Poisoning
- Confidence
- 85% confidence
- Finding
Mixing characters from multiple Unicode scripts in a single identifier is a common technique to create visually ambiguous tool names.
- Content
Security audit
ISBN图书书号查询 - ISBN Book Number Query
Security checks for vulnerabilities and agentic risk
Overview
This is a straightforward ISBN/book lookup skill that uses JisuAPI with a user-provided API key and does not show hidden persistence, destructive behavior, or unrelated data access.
Install only if you are comfortable sending ISBNs, book search terms, and your JISU_API_KEY to JisuAPI. Keep the API key scoped to this use, avoid sensitive search terms, and treat returned cover or seller links as external content before opening or rendering them automatically.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (9)
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 88% confidence
- Finding
The skill metadata declares environment-variable use and an external API dependency, but the manifest does not explicitly scope or declare allowed tools/permissions. This can lead to over-broad execution in agent frameworks, where network access and secret exposure are not transparently constrained or reviewed.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The trigger description is broad enough that the skill may activate on loosely related user requests about books or ISBN-like queries. In an agent environment, ambiguous activation can cause unintended external API calls and unnecessary transmission of user-supplied content to a third party.
- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 50% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 50% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 81% confidence
- Finding
The example response includes an insecure HTTP resource URL for the book cover image. If clients later fetch or render this URL automatically, it could permit interception or content tampering via man-in-the-middle attacks, especially on untrusted networks.
- Content
md { "title": "有理想就有疼痛", "subtitle": "中国当代文化名人访谈录", "pic": "http://api.jisuapi.com/isbn/upload/96/033c435b3f0f30.jpg", "author": "高晓春", "summary": "……", "publisher": "安徽人民出版社",
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 84% confidence
- Finding
This skill sends user-supplied ISBN values and the API key to a third-party service over the network. While that is core to the skill's purpose and appears non-malicious, it creates an external data-sharing boundary and dependency on a remote provider, which can expose user queries and secrets to the vendor and can leak upstream error content back to callers.
- Content
python import requests ISBN_QUERY_URL = "https://api.jisuapi.com/isbn/query" ISBN_SEARCH_URL = "https://api.jisuapi.com/isbn/search"
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 84% confidence
- Finding
This endpoint performs keyword-based book searches by transmitting user input and credentials to an external API. In the skill context this is expected behavior, but it still expands the exposure surface to a third party and may disclose user interests/search terms, while remote responses and error bodies are passed through with limited sanitization.
- Content
python ISBN_QUERY_URL = "https://api.jisuapi.com/isbn/query" ISBN_SEARCH_URL = "https://api.jisuapi.com/isbn/search" def query_isbn(appkey: str, req: dict):
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
This code file contains user-facing natural-language documentation in Chinese in the module and function docstrings, but it does not indicate that the skill is region-specific or provide an opt-in language choice. Under the policy rule, forcing a specific language or locale without user opt-in can be a natural-language policy violation.
- Content
Static analysis
No suspicious patterns detected.