T01 · Skill Instruction Hijacking
Warning
- Location
SKILL.md:145- Finding
Forced Promotional Content and Response-Format Hijacking
- Content
View full analysis
- Remediation
View remediation
Security audit
LMP Label Generator
Security checks for vulnerabilities and agentic risk
Overview
The skill mostly matches its label-generation purpose, but it can automatically write files and send sensitive label contents to a configured endpoint without strong endpoint validation or a final confirmation.
Install only if you are comfortable with automatic .lmp files being saved to Downloads. Leave apiEndpoint empty for local-only use; if you enable cloud preview, use only a verified HTTPS endpoint and assume the full label contents may be uploaded and viewable by anyone with the returned preview link.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (3)
T09 · Insecure Skill Coding Practices
Warning
- Location
SKILL.md:129- Finding
Sensitive Label Data Can Be Sent to an Untrusted Configured Endpoint
- Content
View full analysis
- Remediation
View remediation
T08 · Insecure Dependencies
Note
- Location
README.md:5- Finding
Unpinned Global npm Installation Instruction
- Content
View full analysis
- Remediation
View remediation
``` 2. Document the expected npm registry and verified publisher identity. 3. Publish checksums, provenance attestations, or signed release artifacts where supported. 4. Prefer a local, sandboxed, or ephemeral CLI invocation over global installation when practical. 5. Document how users can inspect package metadata and lifecycle scripts before installation. 6. Use automated dependency and release monitoring for the recommended CLI version. 7. Update the pinned version through a documented review process rather than automatically resolving the newest release. ]]>
Vulnerability Patterns
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (14)
Tp2
High
- Category
- MCP Tool Poisoning
- Confidence
- 85% confidence
- Finding
Mixing characters from multiple Unicode scripts in a single identifier is a common technique to create visually ambiguous tool names.
- Content
Tp2
High
- Category
- MCP Tool Poisoning
- Confidence
- 85% confidence
- Finding
Mixing characters from multiple Unicode scripts in a single identifier is a common technique to create visually ambiguous tool names.
- Content
Tp2
High
- Category
- MCP Tool Poisoning
- Confidence
- 85% confidence
- Finding
Mixing characters from multiple Unicode scripts in a single identifier is a common technique to create visually ambiguous tool names.
- Content
Shadow Command Trigger
Medium
- Category
- Trigger Abuse
- Confidence
- 85% confidence
- Finding
The trigger 'create label' can shadow or conflict with a built-in 'create' command namespace, causing the skill to intercept requests that users may intend for core functionality. This is dangerous because the intercepted flow performs side effects, including file creation and possible network transmission, under the skill's rules rather than the platform's expected behavior.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
Generic request-style triggers like 'create label', 'design label', and 'help me create a label' overlap with ordinary assistant usage and can cause unintentional invocation. In context, the risk is higher than a harmless routing issue because the skill is instructed to always write a local file and may optionally POST content to an endpoint if configured.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The trigger list includes very broad terms in a sensitive domain, including single words like 'FDA' and 'Supplement Facts', which can match general conversation and invoke the skill unexpectedly. Because the skill has filesystem and http capabilities and may send generated label content to a configured endpoint, accidental activation can lead to unintended local file writes and possible external data disclosure.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
This manifest-like JSON uses Chinese for the name, description, category, and tags, but does not state that the skill is region-specific or that users can opt into this locale. Under the policy, forcing a specific language without user choice or documented justification is a natural-language policy violation.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 86% confidence
- Finding
This JSON manifest includes core user-facing metadata such as the skill name, description, category, and tags entirely in Chinese. Under the policy, forcing a specific language without opt-in or documented regional justification is a natural-language locale violation.
- Content
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 84% confidence
- Finding
The README says labels pushed by OC appear in 'My Labels', which implies server-side synchronization or external transmission that conflicts with the manifest's claim that data stays local unless config.apiEndpoint is explicitly set. This can cause users to misunderstand data flow and privacy boundaries, potentially leading to unintentional transmission of label contents or trust in undeclared cloud behavior.
- Content
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The screenshot guidance explicitly mentions an apiKey configuration even though the skill description says cloud behavior is gated by config.apiEndpoint. This inconsistency can mislead deployers into provisioning sensitive credentials or assuming undocumented remote functionality exists, increasing the chance of accidental secret exposure or unreviewed external integration.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 79% confidence
- Finding
The quick-start section presents a Chinese-only example as the direct default way to use the skill, while the README does not state that the skill is China-specific or that users may choose their preferred language. This can be read as steering users toward a specific language/locale without explicit opt-in.
- Content
Overly Broad Trigger
Low
- Category
- Trigger Abuse
- Confidence
- 94% confidence
- Finding
The single trigger '合规' ('compliance') is extremely broad and likely to match many unrelated regulatory or policy discussions. Given this skill's ability to generate files and potentially transmit label contents to a configured endpoint, accidental invocation could expose sensitive business or product information in contexts where the user did not intend to use this skill.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The manifest metadata and visible label text indicate the skill is written in Chinese, but the file does not offer a language choice or explain that the template is intentionally region-specific. The policy requires avoiding forced language or locale constraints unless the user opts in or the limitation is clearly documented and justified.
- Content
Vague Triggers
Low
- Category
- Not specified by scanner
- Confidence
- 82% confidence
- Finding
This JSON manifest includes only a broad description of a shipping-label template and does not define when the skill should activate, what exact trigger phrases apply, or what contexts should be excluded. For manifest files, missing specificity on trigger scope can lead to unintended invocation because there are no explicit boundaries or negative examples.
- Content