Tp2
High
- Category
- MCP Tool Poisoning
- Confidence
- 85% confidence
- Finding
Mixing characters from multiple Unicode scripts in a single identifier is a common technique to create visually ambiguous tool names.
- Content
Security audit
Prompting Modes - 高级推理模式工具箱
Security checks for vulnerabilities and agentic risk
Overview
This is not overtly malicious, but it can steer ordinary requests into tool, file, database, browser, and code-execution workflows without clear user confirmation rules.
Install only if you want a Chinese-language prompt-routing skill that may encourage the agent to use tools for research and execution. Before using ReAct or Plan-and-Execute modes, require explicit confirmation for code execution, database access, file-system reads, browser actions, and any state-changing operation.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Vulnerability Patterns
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- Behavioral ASTexec() Call, eval() Call, Dynamic Import
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (11)
Tp2
High
- Category
- MCP Tool Poisoning
- Confidence
- 85% confidence
- Finding
Mixing characters from multiple Unicode scripts in a single identifier is a common technique to create visually ambiguous tool names.
- Content
Tp2
High
- Category
- MCP Tool Poisoning
- Confidence
- 85% confidence
- Finding
Mixing characters from multiple Unicode scripts in a single identifier is a common technique to create visually ambiguous tool names.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The description states the skill may be used when a task 'needs a particular reasoning strategy,' which is subjective and lacks enforceable boundaries. That ambiguity increases the chance of automatic routing into higher-interaction modes like ReAct or Plan-and-Execute without sufficiently clear user consent or policy gating.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 87% confidence
- Finding
The manifest description, triggers, headings, and usage instructions are written entirely in Chinese, and the trigger set is also Chinese-specific. There is no indication that users may choose another language or that the locale restriction is intentional for a region-specific skill.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
Several triggers such as '一步一步思考', '使用工具解决', and '生成详细计划' are broad phrases that can appear in ordinary user requests, making unintended activation likely. This can alter agent behavior unexpectedly, causing oversharing of reasoning structure, unnecessary tool use, or execution of a more powerful workflow than the user explicitly intended.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The ReAct section explicitly maps the skill to search, file-system querying, database access, and code execution behaviors, but it does not define safety checks, permission limits, or user-confirmation requirements for potentially impactful actions. In an agent environment, this can normalize escalating from reasoning assistance into operational actions that may expose data or change system state.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 87% confidence
- Finding
The automatic mode-selection logic uses subjective criteria such as '需要工具', '高准确率', and '需要解释' without clear boundaries, so the agent may invoke higher-risk reasoning modes when not intended. In this skill context, ambiguous auto-selection is particularly risky because some modes alter behavior significantly, including multi-path reasoning and tool-calling loops, which expands the attack surface for prompt injection and unintended actions.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The explicit trigger phrases are broad, common-language terms like '搜索', '计划', and '步骤', which can appear in ordinary user requests without an actual intent to activate a special reasoning mode. In an agent skill, this can cause unintended mode switching, including unnecessary tool-use behavior or disclosure of structured reasoning patterns, increasing the chance of policy bypass, prompt steering, or unexpected execution paths.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The manifest description is written entirely in Chinese and presents the skill as a Chinese-language toolbox without any indication that users can select another language or that the skill is intended only for a Chinese-speaking context. This can violate language/locale policy expectations when a skill implicitly forces a specific language without user opt-in.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The file title and all instructional content are written exclusively in Chinese, with no indication that language choice is optional or that the document is intended only for a Chinese-speaking or region-specific audience. This can violate a language/locale policy when a skill or reference material imposes a specific language without user opt-in.
- Content