Tp2
High
- Category
- MCP Tool Poisoning
- Confidence
- 85% confidence
- Finding
Mixing characters from multiple Unicode scripts in a single identifier is a common technique to create visually ambiguous tool names.
- Content
Security audit
frontend-skill
Security checks for vulnerabilities and agentic risk
Overview
This is a simple frontend-development instruction skill with minor language, routing, and default-stack caveats but no hidden execution or data-access behavior.
Install this only if you want a broad frontend helper that may activate for many UI/web-development requests and may default to React, Next.js, Tailwind CSS, shadcn/ui, and TypeScript unless you specify otherwise.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Vulnerability Patterns
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (7)
Tp2
High
- Category
- MCP Tool Poisoning
- Confidence
- 85% confidence
- Finding
Mixing characters from multiple Unicode scripts in a single identifier is a common technique to create visually ambiguous tool names.
- Content
Tp2
High
- Category
- MCP Tool Poisoning
- Confidence
- 85% confidence
- Finding
Mixing characters from multiple Unicode scripts in a single identifier is a common technique to create visually ambiguous tool names.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The README describes the skill entirely in Chinese and presents the skill persona/behavior as fixed, without indicating that language can be chosen based on user preference. Under the policy, forcing a specific language or locale without opt-in is a natural-language policy violation unless clearly justified as region-specific.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The trigger list is very broad and overlaps with many ordinary frontend requests, increasing the chance that this skill activates in situations the user did not specifically intend. Over-broad routing can cause unintended delegation, policy bypass through skill over-selection, or inappropriate application of this skill's defaults and instructions to unrelated tasks.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 76% confidence
- Finding
The primary descriptive and trigger content is provided only in Chinese, with no statement that the skill can adapt to the user's preferred language. This may violate language-choice expectations if the skill is used in multilingual environments.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 80% confidence
- Finding
The description states that when the user has no special stack requirement, the skill will default to a specific "mainstream cutting-edge" frontend stack. This imposes a technology and workflow preference without an explicit user opt-in or presented choice.
- Content
Static analysis
No suspicious patterns detected.