Tp2
High
- Category
- MCP Tool Poisoning
- Confidence
- 85% confidence
- Finding
Mixing characters from multiple Unicode scripts in a single identifier is a common technique to create visually ambiguous tool names.
- Content
Security audit
ZeeLin 闲鱼自运营
Security checks for vulnerabilities and agentic risk
Overview
This is a disclosed Xianyu/Goofish browser assistant for drafting and confirming marketplace replies or listings, with some broad trigger wording users should watch.
Install only if you want an agent to read and operate a logged-in Xianyu/Goofish browser session. Keep review enabled for replies, prices, after-sales promises, and publishing, and confirm the correct account, product, buyer/seller role, and conversation before allowing any send or publish action.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Vulnerability Patterns
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (3)
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The trigger list is broad enough to activate on many generic marketplace or customer-service requests, which can cause the agent to invoke browser automation in the wrong context. Because this skill is designed to act on a logged-in marketplace account, accidental invocation can lead to unintended reading of conversations, drafting replies, or preparing listing changes on behalf of the user.
- Content
Vague Triggers
Low
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The invocation examples specify when to use the skill but not when to avoid it, leaving routing ambiguous. In a browser-automation skill that operates on an already logged-in account, ambiguous scope increases the chance of misrouting unrelated requests into account-affecting workflows, potentially exposing messages or causing unintended actions.
- Content