Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 95% confidence
- Finding
声明描述的是一个较完整的多平台自动回复系统，而代码仅提供回复结构模板与格式建议的本地CLI脚本。它没有接入任何平台，也没有监听、触发、发送回复的能力；也未进行关键词规则匹配。所谓AI生成仅是返回固定占位文本“[AI根据上下文自动生成]”。因此代码行为与声明的主要用途存在实质差异，属于描述明显夸大功能的情况。
- Content
Security audit
上门体育-多平台自动回复
Security checks for vulnerabilities and agentic risk
Overview
This is a Chinese-language auto-reply template helper with no hidden data access or execution, though it overstates how much automation and AI generation it actually implements.
Use this as a template library and reply-format helper, not as a ready-to-run automation system. Before deploying any keyword rules to real customer or public channels, narrow generic triggers like price and booking terms, review platform policy compliance, and manually verify generated copy.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Vulnerability Patterns
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (11)
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 70% confidence
- Finding
Without declared permissions the skill's intent is opaque and cannot be validated.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
Overly broad trigger phrases can cause the skill to activate on ordinary user requests outside the intended context, increasing the chance of unintended prompt injection surface, incorrect workflow selection, or disclosure of irrelevant canned instructions. In an assistant environment with multiple skills, ambiguous activation can override more appropriate behaviors and lead to unsafe or confusing responses.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 84% confidence
- Finding
The natural-language description, usage guidance, triggers, and examples are all presented as Chinese-only operational guidance, with no indication that the user may choose another language or locale. This can constitute a language/locale policy issue when the skill implicitly enforces a single language without opt-in.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The instruction to run whenever the user has an 'auto-reply need' is vague and effectively self-expanding, which can make the skill activate in situations where the user only seeks general advice, messaging help, or unrelated automation. This broad activation increases the likelihood of unintended behavior and can be abused to steer the assistant into a narrower workflow than the user intended.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 86% confidence
- Finding
This manifest-style JSON uses a very generic activation keyword, "预约", as an auto-reply trigger. Because the file does not define context limits, exclusions, or negative examples, ordinary conversation containing this common word could invoke the skill unintentionally.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
Keywords such as "价格", "收费", "多少钱", "预约", and "体验" are broad everyday terms that can appear in many unrelated conversations. The configuration does not provide scoping rules or negative examples to distinguish intended service inquiries from incidental mentions.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 84% confidence
- Finding
The Feishu keyword replies activate on short common terms like "价格", "收费", and "预约" with no contextual boundaries. In a chat environment, these broad terms are likely to collide with ordinary discussion and trigger unintended responses.
- Content
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The module docstring and generate_reply docstring state that the script generates suitable replies based on platform, message, and tone, suggesting actual reply generation. In practice, the code always sets suggested_reply to the fixed placeholder "[AI根据上下文自动生成]" and only assembles metadata and tips, so the documentation overstates what the implementation does.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The file’s natural-language description and all user-facing defaults are written exclusively in Chinese, and the script constrains platform/tone values to Chinese-only options. There is no indication that the skill is region-specific or that users may opt into another language, which can violate language/locale policy requirements.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
Natural-language strings throughout the configuration force Chinese-language interactions, and there is no indication that users can opt into another language or that the skill is intentionally limited to a Chinese-language audience. This may violate language/locale policy when used in broader multilingual environments.
- Content
Static analysis
No suspicious patterns detected.