Tp2
High
- Category
- MCP Tool Poisoning
- Confidence
- 85% confidence
- Finding
Mixing characters from multiple Unicode scripts in a single identifier is a common technique to create visually ambiguous tool names.
- Content
Security audit
周公解梦 - Duke of Zhou's Dream Interpretation - 极速数据
Security checks for vulnerabilities and agentic risk
Overview
This skill is a straightforward dream-interpretation lookup that sends a user-provided keyword to JisuAPI using a required API key, with no hidden persistence or destructive behavior found.
Install only if you are comfortable providing a JisuAPI key and sending dream search keywords to JisuAPI. Avoid submitting highly personal dream narratives unless needed; use short keywords when possible.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (6)
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 93% confidence
- Finding
The skill advertises that it requires an environment variable and implicitly performs outbound API access, but it does not declare an explicit tool scope such as permissions or allowed-tools. This creates a transparency and policy-enforcement gap: an agent or platform may invoke a networked skill without clear user/admin approval boundaries, increasing the risk of unintended external data transmission.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The skill description omits a privacy warning that user dream descriptions or keywords will be sent to JisuAPI. Dream narratives can contain sensitive personal, medical, sexual, relational, or psychological information, so failing to warn users meaningfully increases the risk of involuntary disclosure to a third party.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The trigger guidance is broad enough to match generic conversational dream-related questions, which can cause the agent to route user content to this external API more often than necessary. Because the skill sends user-provided queries to a third party, overbroad triggering increases privacy exposure and the chance of unexpected tool invocation.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The module description and API context switch into Chinese and the usage example later also uses Chinese terms, which imposes a specific language context without any opt-in or note that the skill is intended only for Chinese-speaking users. The policy requires flagging language or locale constraints when they are forced without user choice or clear justification.
- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 60% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
python import requests DREAM_SEARCH_URL = "https://api.jisuapi.com/dream/search" def _call_dream_api(appkey: str, params: dict = None):
Static analysis
No suspicious patterns detected.