Tp2
High
- Category
- MCP Tool Poisoning
- Confidence
- 85% confidence
- Finding
Mixing characters from multiple Unicode scripts in a single identifier is a common technique to create visually ambiguous tool names.
- Content
Security audit
66天成为优秀班主任 · 跟 Estelle 学
Security checks for vulnerabilities and agentic risk
Overview
This is a Chinese-language homeroom teacher coaching skill with a small local helper script and no evidence of hidden access, network use, persistence, or destructive behavior.
Install this if you want Chinese-language homeroom teacher coaching. Treat mental-health, crisis, safeguarding, and discipline issues as areas requiring school policy and qualified professional judgment rather than relying on the skill alone.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Vulnerability Patterns
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (8)
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
This file presents all operational instructions, templates, and role guidance exclusively in Chinese, and does not indicate that the user can choose another language. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation unless the locale constraint is clearly documented and justified.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The activation table uses broad and ambiguous examples like '问题学生', '心理问题', and '怎么当一个好班主任' without clear scope boundaries or confirmation rules. In an agent environment, this can trigger the skill in edge cases involving minors, discipline, or mental-health topics where specialized safeguards, clearer triage, or a different skill would be more appropriate.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The skill auto-activates on very common distress phrases such as '累', '崩溃', '压力大', which can appear in many unrelated conversations. That can cause the agent to inappropriately steer users into a headteacher workflow, reducing relevance, overriding user intent, or mishandling sensitive situations such as mental-health disclosures outside the skill's domain.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
This file presents the skill's identity, instructions, and operating principles exclusively in Chinese, with no indication that users may choose another language. Under the policy rule, forcing a specific language without user opt-in is a natural-language policy violation unless the locale constraint is clearly documented and justified.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The skill's user-facing strings and command descriptions are entirely in Chinese, with no indication that other languages are supported or that the user can choose their preferred language. Under the policy for natural-language violations, forcing a specific language without opt-in is reportable unless the locale constraint is explicitly documented and justified.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 81% confidence
- Finding
This markdown file presents the skill description and changelog entirely in Chinese, with no indication that users can choose another language or that the skill is intentionally limited to a Chinese-speaking audience. Under the stated policy, a forced language/locale without opt-in can be a natural-language policy violation.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
This file's natural-language instructions and persona definition are presented exclusively in Chinese, and there is no indication that users may choose another language or that the skill is intentionally limited to a Chinese-language context. Under the policy, forcing a specific language without user opt-in is a natural-language policy concern.
- Content
Static analysis
No suspicious patterns detected.