Tp2
High
- Category
- MCP Tool Poisoning
- Confidence
- 85% confidence
- Finding
Mixing characters from multiple Unicode scripts in a single identifier is a common technique to create visually ambiguous tool names.
- Content
Security audit
Historical Weather - 历史天气
Security checks for vulnerabilities and agentic risk
Overview
This skill is a straightforward historical weather lookup tool that sends city/date queries to the documented JisuAPI service using a user-provided API key.
Before installing, make sure you are comfortable sending the queried city/date and your JISU_API_KEY to JisuAPI over HTTPS. Keep the API key scoped to this provider and rotate it if it is exposed.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (6)
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 93% confidence
- Finding
The skill declares access to an environment variable containing an API key and necessarily performs outbound network requests, but it does not define an explicit tool scope such as permissions or allowed-tools. This creates an authorization gap: a host or agent may permit broader execution than intended, making secret access and external communication less constrained and harder to audit.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The description specifies trigger examples and usage entirely in Chinese, which indicates the skill is intended to operate in a single language. There is no note offering language choice or stating that Chinese is optional, so this is a natural-language locale policy concern.
- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 60% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
python import requests BASE_URL = "https://api.jisuapi.com/weather2" def _call_api(path: str, appkey: str, params: dict = None):
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
The skill sends request parameters, including user-provided city/date values and the API key, to a third-party weather service via HTTP. While the module docstring names the API provider, there is no explicit user-facing warning, confirmation, or runtime disclosure that input data will be transmitted off-system.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 77% confidence
- Finding
The only natural-language description in the file is entirely in Chinese, which can constitute a locale/language policy issue when no user opt-in or justification is provided. Nothing in the file indicates the skill is intentionally limited to Chinese-speaking users or a China-specific deployment context.
- Content
Static analysis
No suspicious patterns detected.