Tp2
High
- Category
- MCP Tool Poisoning
- Confidence
- 85% confidence
- Finding
Mixing characters from multiple Unicode scripts in a single identifier is a common technique to create visually ambiguous tool names.
- Content
Security audit
webhook-send
Security checks for vulnerabilities and agentic risk
Overview
This is a straightforward webhook message sender, but its broad triggers and lack of an explicit confirmation/privacy guard make accidental external posting a real review concern.
Install only if you trust and control WEBHOOK_SEND_URL and understand that message text or Markdown will be sent to that endpoint. Prefer tightening triggers to explicit webhook-send phrases and require a clear user confirmation before any POST, especially if the webhook posts into a shared group or business channel.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (10)
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The README explicitly documents that the skill will POST message content to a webhook endpoint taken from an environment variable, but it provides no warning that user-supplied content will leave the local system and be transmitted to an external service. In a messaging/notification skill, this omission can lead to accidental disclosure of sensitive data, especially if users assume the action is purely local or do not understand where the webhook points.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 74% confidence
- Finding
All user-facing natural-language content in the manifest and documentation is written only in Chinese, with no indication that the skill supports other languages or that Chinese is a required locale. Under the policy, a skill should not impose a language or locale without user opt-in or a clearly documented regional justification.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The manifest includes broad everyday triggers like '通知', '群组', and '机器人', which can cause the skill to activate for unrelated user requests. Because this skill sends outbound webhook messages, unintended invocation can lead to accidental message delivery to external systems and misuse of the configured webhook endpoint.
- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 60% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
curl 示例
bash # 替换 WEBHOOK_URL 为实际地址
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 84% confidence
- Finding
SQP-3 applies to natural-language policy issues in any file type, including markdown. The file presents all instructions and examples only in Chinese and does not indicate that the user can choose another language, which may violate a language-choice policy if organizational guidance requires opt-in rather than a forced locale.
- Content
Overly Broad Trigger
Low
- Category
- Trigger Abuse
- Confidence
- 86% confidence
- Finding
The trigger '群组' is overly short and generic, making accidental activation likely when users discuss group chats or group notifications. Since the skill performs an external HTTP POST to a preconfigured webhook, unintended triggering can cause unauthorized or confusing outbound notifications.
- Content
Overly Broad Trigger
Low
- Category
- Trigger Abuse
- Confidence
- 87% confidence
- Finding
The trigger '通知' is a highly generic everyday term that could match many unrelated conversations about notifications. In a skill that emits external webhook POST requests, this increases the risk of accidental activation and unintended message transmission to third-party systems.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 78% confidence
- Finding
The file's natural-language instructions and examples are presented only in Chinese, which may amount to a language policy violation if users are not given an explicit language or locale choice. There is no indication that the document is intentionally region-specific or that an alternative language is available.
- Content
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 84% confidence
- Finding
This markdown file describes sending JSON payloads via POST to a webhook URL, which is a network operation that can transmit user or system data off-host. The document provides usage details and a curl example but does not include any warning or disclosure about the privacy or data-sharing implications of sending content to the webhook endpoint.
- Content