Tp2
High
- Category
- MCP Tool Poisoning
- Confidence
- 85% confidence
- Finding
Mixing characters from multiple Unicode scripts in a single identifier is a common technique to create visually ambiguous tool names.
- Content
Security audit
3Q-quality-system
Security checks for vulnerabilities and agentic risk
Overview
This is a disclosed Markdown-only quality-review framework, with some broad activation phrases and adaptive-review language users should control explicitly.
Install only if you want a Chinese-first quality-review workflow. Use explicit invocations for 3Q checks, and do not allow it to persist new rules, change installed skills, launch review agents, or run external searches unless you have asked for that action.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Vulnerability Patterns
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (12)
Tp2
High
- Category
- MCP Tool Poisoning
- Confidence
- 85% confidence
- Finding
Mixing characters from multiple Unicode scripts in a single identifier is a common technique to create visually ambiguous tool names.
- Content
Tp2
High
- Category
- MCP Tool Poisoning
- Confidence
- 85% confidence
- Finding
Mixing characters from multiple Unicode scripts in a single identifier is a common technique to create visually ambiguous tool names.
- Content
Tp2
High
- Category
- MCP Tool Poisoning
- Confidence
- 85% confidence
- Finding
Mixing characters from multiple Unicode scripts in a single identifier is a common technique to create visually ambiguous tool names.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The triggers, headings, instructions, and examples are overwhelmingly written in Chinese, and the usage examples direct the user to invoke and operate the skill in Chinese. The file does not offer an explicit language choice or explain that the skill is intended only for a Chinese-speaking or region-specific context.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
Several triggers are broad everyday phrases, which can cause the skill to activate when a user is discussing review processes rather than intentionally invoking this skill. Unintended activation can inject the skill's behavioral instructions into unrelated conversations, altering agent behavior and potentially interfering with safer task-specific handling.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
This markdown skill presents all instructions and guidance exclusively in Chinese, and there is no natural-language indication that users may choose another language or that the skill is intentionally limited to a Chinese-speaking audience. Under the policy rule for language/locale constraints, forcing a specific language without user opt-in is a reportable issue.
- Content
Overly Broad Trigger
Low
- Category
- Trigger Abuse
- Confidence
- 91% confidence
- Finding
The trigger '预检' is a short, common term that could appear in many ordinary user requests. If the skill activates on such a generic phrase, it may unexpectedly steer the assistant into this framework, causing instruction injection-by-trigger and unintended workflow changes.
- Content
Overly Broad Trigger
Low
- Category
- Trigger Abuse
- Confidence
- 86% confidence
- Finding
The trigger '盲审' is short and semantically common in review contexts, so it can match benign discussion unrelated to this skill. This can cause accidental invocation and unnecessary insertion of the skill's instructions into the conversation.
- Content
Overly Broad Trigger
Low
- Category
- Trigger Abuse
- Confidence
- 86% confidence
- Finding
The trigger '六问' is too generic and may naturally occur in educational, planning, or discussion contexts. Such broad matching can activate the skill unintentionally and interfere with normal task execution.
- Content
Overly Broad Trigger
Low
- Category
- Trigger Abuse
- Confidence
- 87% confidence
- Finding
The trigger '自审' is a common term for self-review and can occur in many benign conversations. Accidental activation could redirect the assistant into the skill's prescribed process even when the user did not request this specific framework.
- Content
Vague Triggers
Low
- Category
- Not specified by scanner
- Confidence
- 83% confidence
- Finding
The scenario descriptions are expansive and loosely bounded, making it more likely the runtime may consider this skill applicable across many unrelated tasks. Over-broad applicability increases the chance of prompt/instruction collision, where this quality-review framework overrides or distracts from more appropriate workflows.
- Content
Static analysis
No suspicious patterns detected.