Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 70% confidence
- Finding
Without declared permissions the skill's intent is opaque and cannot be validated.
- Content
Security audit
Diff Tool
Security checks for vulnerabilities and agentic risk
Overview
This is a straightforward local text/file diff skill with no evidence of hidden, persistent, destructive, or network behavior.
Install this if you want a local diff helper and are comfortable with Chinese-language help text. Only pass files you actually intend to compare, since the tool will read and print differences from those user-specified paths. Publishers should consider replacing the generic "diff" trigger with more specific trigger phrases and documenting tool scope explicitly.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Vulnerability Patterns
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (8)
Shadow Command Trigger
Medium
- Category
- Trigger Abuse
- Confidence
- 90% confidence
- Finding
The trigger 'diff' collides with a well-known built-in command name, creating shadowing risk. In systems that resolve skills and native commands through shared namespaces, this can cause user requests intended for the trusted built-in diff behavior to be intercepted by the skill instead.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 84% confidence
- Finding
The manifest description and visible instructions are entirely in Chinese, and the listed trigger phrases are predominantly Chinese, which effectively constrains usage to a specific language. There is no indication that users can choose another language or that the locale restriction is intentional and documented as region-specific.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The trigger phrase set includes broad terms such as 'diff' and generic comparison language that may match ordinary user requests and invoke the skill unexpectedly. Overbroad activation can cause the agent to route unrelated prompts to this skill, increasing the chance of unintended file handling or command execution in environments where skills are auto-selected.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The trigger phrase "diff" is extremely generic and likely to appear in many unrelated user requests, which can cause this skill to activate outside its intended scope. In an agent ecosystem, broad trigger collisions can route user input to the wrong tool, creating confused-deputy behavior, unintended file handling, or exposure of content to a skill the user did not mean to invoke.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 78% confidence
- Finding
The natural-language content in this file is entirely Chinese for the description and most triggers, but there is no indication that the skill is intentionally region-specific or that users can opt into this locale. Per the policy, forcing a specific language without opt-in can be a language/locale policy violation.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The module description and user-facing help text present the skill in Chinese only, which can effectively force a specific language on users without opt-in. The policy allows locale constraints when they are explicitly justified, but no such justification or language choice is provided here.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The argparse description, examples, subcommand help, and argument help strings are all user-facing natural language in Chinese. Because the file does not offer a language/locale choice or document a justified regional restriction, this appears to violate the language/locale policy.
- Content