Tp2
High
- Category
- MCP Tool Poisoning
- Confidence
- 85% confidence
- Finding
Mixing characters from multiple Unicode scripts in a single identifier is a common technique to create visually ambiguous tool names.
- Content
Security audit
Vehicle License Plate Number Restriction - 车辆尾号限行
Security checks for vulnerabilities and agentic risk
Overview
This skill does what it says: it queries a disclosed third-party traffic restriction API using a user-provided city/date and API key.
Install only if you are comfortable using JisuAPI and sending the requested city/date plus your JISU_API_KEY to that service. Avoid entering unrelated personal information in queries, and review JisuAPI account terms, quota, and privacy expectations before use.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (6)
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 89% confidence
- Finding
The skill declares environment-variable and implied network usage in metadata, but does not define an explicit tool scope such as allowed tools or permissions. That can weaken sandboxing and review controls by making external requests and secret access less transparent to the host and user, especially for a skill that depends on a third-party API key.
- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 60% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
python import requests VEHICLE_CITY_URL = "https://api.jisuapi.com/vehiclelimit/city" VEHICLE_QUERY_URL = "https://api.jisuapi.com/vehiclelimit/query"
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 60% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
python import requests VEHICLE_CITY_URL = "https://api.jisuapi.com/vehiclelimit/city" VEHICLE_QUERY_URL = "https://api.jisuapi.com/vehiclelimit/query"
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
The documentation describes the external JisuAPI backend, but it does not clearly warn end users that their query inputs will be transmitted to a third-party service. This creates a privacy and transparency issue because location/date requests and usage patterns may be shared off-platform without explicit user awareness.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
This code file contains natural-language documentation exclusively in Chinese, including the skill description and API reference context. Under the policy, forcing a specific language without offering user opt-in or alternatives is a locale/language policy concern.
- Content
Static analysis
No suspicious patterns detected.