Tp2
High
- Category
- MCP Tool Poisoning
- Confidence
- 85% confidence
- Finding
Mixing characters from multiple Unicode scripts in a single identifier is a common technique to create visually ambiguous tool names.
- Content
Security audit
StockStar LLM Ranking - 证券之星大模型调用排行榜
Security checks for vulnerabilities and agentic risk
Overview
This skill fetches a fixed public StockStar leaderboard and formats it, with no evidence of hidden access, persistence, credential use, or local data mutation.
Before installing, be aware that the skill makes live outbound requests to tech.stockstar.com and is intended mainly for Chinese-language ranking queries. Use or configure it so it runs only when you explicitly ask for the StockStar LLM invocation leaderboard.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Vulnerability Patterns
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (7)
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 92% confidence
- Finding
The skill invokes a Python CLI that fetches live data from an external website, but the manifest declares no explicit tool scope or permission boundaries. This creates an authorization gap where a host agent may permit network-capable execution without clear user-visible constraints, increasing the risk of unintended outbound requests or future capability creep.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The trigger list contains very broad terms like '排行榜', '大模型', '厂商', and model brand names that can appear in ordinary conversation unrelated to this skill. Overbroad activation can cause the agent to invoke the skill unexpectedly, leading to unnecessary network access, confused responses, and accidental disclosure of external-content-derived data in contexts where the user did not intend tool use.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The activation guidance says the skill should trigger whenever users mention loosely related topics such as rankings, top-N, model names, or vendors, without clear decision boundaries. In a skill that performs external retrieval, ambiguous invocation increases the chance of unintended tool execution and makes prompt-routing easier to manipulate through incidental keyword inclusion.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
This code file contains user-facing natural-language strings entirely in Chinese, including the module description, help text, examples, and error messages. Under the language/locale policy, forcing a specific language without user opt-in can be a policy violation when no alternative locale or language selection is provided.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The config hard-codes an Accept-Language header of "zh-CN,zh;q=0.9,en;q=0.8", which forces a specific locale preference for all requests. This is a natural-language/locale policy concern because the skill does not offer the user any language choice or document a justified region-specific constraint.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 82% confidence
- Finding
This code file contains natural-language documentation entirely in Chinese and explicitly states Chinese-preserving output behavior, but provides no indication that language is configurable or optional. Under the policy rule for language/locale choice, this can be interpreted as forcing a specific language without user opt-in.
- Content
Static analysis
No suspicious patterns detected.