表情符号工具箱

• Outcome: Review
• Latest audit: Sep 16, 2026 · 10:32 AM UTC
• Version: 1.0.1

Overview

The skill is a disclosed emoji steganography tool, but it actively teaches covert public-chat messaging and hidden transfer of token-like bearer assets, so users should review it carefully before installing.

Install only if you intentionally want a local Unicode steganography helper. Do not use it to hide secrets, credentials, private keys, recovery phrases, session tokens, or transferable digital tokens in chat; the hidden data is not encryption and can be recovered by anyone who preserves and decodes the underlying Unicode string. Review the broad tool permissions and the unrelated routing language before using it in an agent environment.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

Findings (1)

other

Warning

• Location: SKILL.md:34

Finding

Covert Data Concealment Through Invisible Unicode Variation Selectors

Content

View full analysis

**Hide messages inside emoji. Unicode variation selectors make covert communication possible.** Some information needs to be transmitted through public channels without being immediately visible. The Emoji Toolkit uses Unicode Variation Selectors (VS1–VS256) to encode text inside emoji. Chat applications display only the emoji itself, but the hidden variation-selector characters remain intact and allow the recipient to decode the original text. ## Core Concept ┌──────────────────────────────────────────────────┐ │ Hidden-message encoding │ ├──────────────────────────────────────────────────┤ │ │ │ Visible layer: Emoji displayed to recipient │ │ 🥜 │ │ │ │ Hidden layer: Embedded variation-selector data │ │ 🥜 + VS1VS2VS3...VS256 │ │ (Each VS represents one byte) │ │ │ │ Encoding: │ │ Text → UTF-8 bytes → VS mapping → Emoji │ │ │ │ Decoding: │ │ Emoji → Extract VS data → Bytes → Text │ │ │ └──────────────────────────────────────────────────┘ ``` Additional supporting instructions appear at `SKILL.md`, lines 116–142 and 244–273. They recommend encoding arbitrary text or transferable token strings, selecting uncommon emoji so the carrier is less noticeable, and transmitting the resulting payload ...[truncated 2722 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (9)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The skill prominently describes covert message hiding and token transfer without placing misuse, detectability, or legal/policy warnings at the point of introduction. Because the core feature is steganographic concealment, the missing up-front warning increases the risk that users or agents will treat covert communication as routine and acceptable by default.

Content

No source excerpt is available for this finding.

Ssd 2

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The content explicitly promotes covert communication through invisible Unicode variation selectors, which is a stealth-enabling mechanism rather than a neutral encoding feature. In the context of a skill with exec capability, normalizing hidden-message transfer materially increases abuse potential for exfiltration, evasion of moderation, or covert coordination.

Content

No source excerpt is available for this finding.

Ssd 2

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The operational advice gives stealth-oriented preservation guidance, such as selecting inconspicuous emoji and adding trailing text to reduce truncation, which directly optimizes covert payload delivery. That moves the skill from describing a format to helping users evade loss and scrutiny, making misuse substantially easier.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

The capability coverage text abruptly expands the skill's scope from emoji steganography and token parsing to unrelated data-analysis tasks. This kind of scope drift is dangerous because it can cause agents to invoke the skill in unintended contexts, increasing the chance of inappropriate execution, confused delegation, or misuse of the provided exec capability.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The skill includes overly broad trigger language unrelated to its documented domain, which can cause accidental or opportunistic invocation for tasks it was not designed to handle. In an agent environment, overbroad routing phrases are risky because they bypass least-privilege principles and may grant exec-backed behavior in contexts outside the intended workflow.

Content

No source excerpt is available for this finding.

Ssd 4

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The scenario provides step-by-step covert messaging instructions for use in public group chats specifically to avoid drawing attention. This contextual framing normalizes deceptive concealment behavior and turns the documentation into actionable operational guidance for covert communications.

Content

No source excerpt is available for this finding.

Ssd 4

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The second scenario walks users through concealing token-like strings during transmission to reduce exposure, which directly supports hidden transfer of sensitive bearer material. Since the document itself states that such tokens should be treated like cash, concealment guidance raises the risk of theft, unmonitored transfer, and policy evasion.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The skill claims all operations are local and require no networking, yet the error handling guidance tells users to test connectivity with ping and troubleshoot firewall/proxy issues. This contradiction can mislead an agent into performing unnecessary network diagnostics or assuming network access is expected, which widens operational behavior beyond the stated trust boundary.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 83% confidence

Finding

The file states '完全中文化表达，适配中文用户使用场景', and the document is overwhelmingly Chinese-language without indicating that other languages are available on request. This can conflict with language/locale choice policies when a skill forces one locale without user opt-in or justification.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.