Tp2
High
- Category
- MCP Tool Poisoning
- Confidence
- 85% confidence
- Finding
Mixing characters from multiple Unicode scripts in a single identifier is a common technique to create visually ambiguous tool names.
- Content
Security audit
Deslop
Security checks for vulnerabilities and agentic risk
Overview
This is a markdown-only writing rewrite skill whose broad triggers may cause accidental activation, but its behavior is disclosed, purpose-aligned, and not privileged.
Installers should be aware that the skill may activate on broad writing-related phrases. Use it when you actually want prose rewritten to sound less AI-generated, review the final rewritten text before replacing originals, and avoid using it for code comments, commits, or academic work unless separately supported.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Vulnerability Patterns
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (9)
Tp2
High
- Category
- MCP Tool Poisoning
- Confidence
- 85% confidence
- Finding
Mixing characters from multiple Unicode scripts in a single identifier is a common technique to create visually ambiguous tool names.
- Content
Tp2
High
- Category
- MCP Tool Poisoning
- Confidence
- 85% confidence
- Finding
Mixing characters from multiple Unicode scripts in a single identifier is a common technique to create visually ambiguous tool names.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The description says the skill performs Chinese/English anti-AI rewriting in a way that may force Chinese-language behavior without clear user opt-in. That can mis-handle content, alter language unexpectedly, or cause unintended transformation of user data, which is a control-flow and integrity problem in an automated agent environment.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
Several triggers are broad enough to activate on ordinary writing requests unrelated to this specific skill, which can cause unintended routing and application of the skill's rewrite behavior. In an agent system, overbroad activation is a real security/control issue because it can override user intent, process the wrong content, or cause prompt-scope interference across benign tasks.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
This markdown file is entirely written in Chinese, including headings, guidance, examples, and remediation text, with no indication that the language is optional or that users can select another locale. Under the stated policy, forcing a specific language without opt-in is a natural-language policy violation unless the locale restriction is explicitly justified.
- Content
Overly Broad Trigger
Low
- Category
- Trigger Abuse
- Confidence
- 90% confidence
- Finding
The trigger '人味' is extremely short and semantically broad, so it is likely to match unrelated conversations and spuriously invoke the skill. While not directly exploitable for code execution, this kind of accidental activation can still degrade agent safety by hijacking task selection and modifying content the user did not intend to rewrite.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 82% confidence
- Finding
This markdown file contains user-facing guidance exclusively in Chinese, and there is no indication that users may choose another language or that the constraint is required for a specific region or audience. Under the policy rule for natural-language locale constraints, forcing a single language without opt-in can be a violation.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The title "中文 AI vs 人味写作对比" indicates the skill reference is presented only in Chinese, and the file contains no note offering alternative languages or user opt-in. Under the policy rule for language/locale constraints, forcing a specific language without choice can be a natural-language policy violation.
- Content