Tp2
High
- Category
- MCP Tool Poisoning
- Confidence
- 85% confidence
- Finding
Mixing characters from multiple Unicode scripts in a single identifier is a common technique to create visually ambiguous tool names.
- Content
Security audit
StockStar ESG - 证券之星企业ESG信息查询
Security checks for vulnerabilities and agentic risk
Overview
This is a transparent Chinese-language tool for looking up public ESG ratings, with expected outbound requests and no persistence or data mutation.
Install this if you are comfortable with a Chinese-language ESG lookup skill sending stock names, codes, and search terms to public financial-data endpoints. Be aware that its broad ESG-related triggers may activate during general ESG discussions, so review outputs for relevance before relying on them.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Vulnerability Patterns
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (7)
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 87% confidence
- Finding
The skill instructs the agent to invoke a Python CLI that retrieves live data from an external source, but the manifest declares no explicit tool scope or permissions boundary. That mismatch can allow unintended network-capable execution in environments that rely on manifest-level restrictions, increasing the risk of unauthorized outbound requests or tool abuse.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The trigger list contains broad generic terms such as ESG, 评级, 评分, 社会责任, 公司治理, and 可持续发展, which can match many unrelated conversations. Overbroad activation can cause the skill to run unexpectedly, leading to unnecessary external requests, context hijacking, or user confusion when the agent invokes this capability outside its intended scope.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The activation guidance allows triggering from partial topical mentions without firm disambiguation rules, so the skill may engage whenever users mention ESG-related concepts rather than explicitly requesting stock data. In an agentic environment, ambiguous routing can misfire into network-backed actions, exposing user context to external systems and reducing control over tool invocation.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 86% confidence
- Finding
The module docstring and all user-oriented natural-language descriptions in this file are written exclusively in Chinese, which indicates a language-specific constraint. Under the policy, forcing a specific language without opt-in or justification is a natural-language policy issue.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
This code file contains natural-language documentation and CLI descriptions exclusively in Chinese, including the module docstring and command descriptions. That creates a language policy issue if users are not offered a language choice or an opt-in mechanism for Chinese output.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 84% confidence
- Finding
The module docstring and function documentation are written entirely in Chinese, which imposes a specific language on maintainers or users reading embedded help text. Under the policy, language constraints should be optional or explicitly justified; this file provides neither opt-in nor a stated region-specific reason.
- Content