Tp2
High
- Category
- MCP Tool Poisoning
- Confidence
- 85% confidence
- Finding
Mixing characters from multiple Unicode scripts in a single identifier is a common technique to create visually ambiguous tool names.
- Content
Security audit
Github Stars Tracker
Security checks for vulnerabilities and agentic risk
Overview
This is a simple GitHub star-tracking CLI with some documentation gaps, but no evidence of deception, exfiltration, destructive behavior, or privilege escalation.
Before installing, be comfortable with the skill reading your GITHUB_TOKEN if it is set, sending it only to GitHub's API, and writing tracked repository state to ~/.github-stars-tracker.json. Use a minimally scoped token, and note that the current implementation appears to print changes rather than provide real notifications or trend analysis.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (10)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 93% confidence
- Finding
The manifest describes monitoring and notifications but omits important behavioral details such as local persistence to ~/.github-stars-tracker.json, while also overstating capabilities like notification, fork-change alerting, and trend analysis. This mismatch is dangerous because users and agents may approve or invoke the skill under incorrect assumptions about what data is stored locally and what actions are actually performed.
- Content
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 89% confidence
- Finding
The skill advertises executable commands that rely on environment access, local file read/write, and network access, but it declares no explicit tool scope or permissions boundary. That makes the capability surface implicit rather than reviewable, increasing the chance that an agent or user grants broader access than intended and making abuse harder to detect.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 87% confidence
- Finding
The trigger "追踪仓库" is ambiguous because it does not specify GitHub, stars, or repository metrics, and could apply to many unrelated repository-tracking contexts. Without constraints or examples of when not to activate, the trigger scope is too broad.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The trigger phrase "项目动态" is very general and overlaps with everyday discussion about project updates rather than a specific request to invoke this skill. The manifest does not provide narrowing context or exclusion conditions, so this could cause unintended activation.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The script's description, help text, and runtime messages are written in Chinese throughout, which imposes a specific language on all users. The file does not offer a locale selection mechanism or explain that the skill is intentionally region-specific.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
This code accesses the sensitive GITHUB_TOKEN environment variable and transmits it to api.github.com when present. Although the script prints status messages for repository fetches, it does not warn the user that a credential may be consumed and sent on their behalf in code comments, docstrings beyond the title, or user-facing output.
- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 60% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
python import urllib.request import urllib.error url = f"https://api.github.com/repos/{owner}/{repo}" headers = {"Accept": "application/vnd.github.v3+json"} token = get_github_token()
Context-Inappropriate Capability
Low
- Category
- Not specified by scanner
- Confidence
- 76% confidence
- Finding
The manifest describes a monitoring tool for public repository stars and forks. Accessing environment-stored credentials is not clearly justified by that stated purpose, since the tracker can operate against public GitHub repository metadata without requiring user secrets.
- Content
Context-Inappropriate Capability
Low
- Category
- Not specified by scanner
- Confidence
- 80% confidence
- Finding
The manifest emphasizes tracking star growth, fork changes, and project trends, but the code also retrieves watchers, description, language, and updated timestamp. While repository API access is expected, collecting unrelated metadata goes beyond the narrowly stated monitoring purpose.
- Content