Tp2
High
- Category
- MCP Tool Poisoning
- Confidence
- 85% confidence
- Finding
Mixing characters from multiple Unicode scripts in a single identifier is a common technique to create visually ambiguous tool names.
- Content
Security audit
FP and A Analyst
Security checks for vulnerabilities and agentic risk
Overview
This is a finance analysis prompt skill with no executable code, external access, or hidden behavior, though its triggers are broader than ideal.
Install only if you want a Chinese-market FP&A assistant. Treat company financials, personnel plans, customer receivables, and management observations as sensitive, and consider narrowing the activation triggers before broad deployment.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Vulnerability Patterns
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (7)
Vague Triggers
High
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The trigger terms are overly broad and overlap with common everyday business language, which can cause the skill to activate in unintended contexts. Misrouting user requests to a finance-focused skill can expose unrelated conversations to domain-specific instructions, create confusing outputs, and increase the attack surface for prompt-trigger hijacking or unauthorized skill invocation.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
描述中明确写明“适用于中国企业的经营环境和决策习惯”，整体内容也默认采用中国本地业务语境与表达，但没有说明这是可选区域模式或需用户主动选择。这种默认地域/locale 约束可能与语言或地区选择应由用户决定的政策相冲突。
- Content
Overly Broad Trigger
Low
- Category
- Trigger Abuse
- Confidence
- 83% confidence
- Finding
The trigger '财务' is extremely broad and likely to match many unrelated conversations, causing unintended activation of this skill. Unnecessary invocation expands the effective prompt surface and can lead to accidental handling of sensitive content under the wrong policy or instruction set.
- Content
Overly Broad Trigger
Low
- Category
- Trigger Abuse
- Confidence
- 84% confidence
- Finding
The trigger '分析' is so generic that it can match a large portion of ordinary user requests across many domains. This creates a clear risk of false activation, which can misroute prompts and broaden exposure to skill-specific instructions without user intent.
- Content
Overly Broad Trigger
Low
- Category
- Trigger Abuse
- Confidence
- 76% confidence
- Finding
The trigger '报表' is generic enough to overlap with many non-finance reporting tasks, increasing the chance of accidental invocation. While the impact is lower than ultra-generic words, it still weakens activation precision and can cause incorrect skill selection.
- Content
Overly Broad Trigger
Low
- Category
- Trigger Abuse
- Confidence
- 78% confidence
- Finding
The trigger '预算' is common in many contexts beyond FP&A, such as project planning, procurement, or personal finance, so it may activate this skill unintentionally. This overbreadth primarily creates prompt-routing and policy-boundary issues rather than direct exploitation, but it is still a genuine control weakness.
- Content