Tp2
High
- Category
- MCP Tool Poisoning
- Confidence
- 85% confidence
- Finding
Mixing characters from multiple Unicode scripts in a single identifier is a common technique to create visually ambiguous tool names.
- Content
Security audit
url-shortener-mobile
Security checks for vulnerabilities and agentic risk
Overview
This is a simple URL-shortening guide that sends user-provided links to public shortening services, with privacy caveats but no hidden code, persistence, or local data access.
Install only if you are comfortable with the agent sending the URL you ask to shorten to public services such as da.gd, cleanuri.com, or tinyurl.com. Do not use it for private intranet links, password reset links, signed URLs, or links containing tokens or personal data unless you are comfortable disclosing that URL to the shortening provider.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (5)
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
Overly broad trigger terms can cause the skill to activate when the user did not intend to shorten a URL, leading to unintended transmission of user-provided links to third-party services. Because this skill explicitly sends URLs off-device via
http_fetch, accidental invocation has privacy implications beyond mere usability issues.- Content
Unrestricted Tool Access
Medium
- Category
- Excessive Agency
- Confidence
- 87% confidence
- Finding
Although the skill is described as instructions-only, it explicitly directs the agent to invoke
http_fetchagainst arbitrary user-supplied URLs wrapped into requests to third-party shortening endpoints. This creates indirect network/tool access without meaningful policy constraints, enabling exfiltration of sensitive URLs to external services whenever the skill is triggered.- Content
md # URL Shortener (guide) This skill is **instructions-only**. It does not run any code on the device. When the user asks to shorten a URL, the agent should use the existing `http_fetch` tool to call one of the public shortener APIs below and then return the response body as the short URL.
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The skill instructs the agent to send user URLs to public third-party shortening services but does not include a clear user-facing warning or consent step. URLs often contain sensitive query parameters, internal paths, or personal identifiers, so silent transmission to external services creates a meaningful privacy and data-handling risk.
- Content
Overly Broad Trigger
Low
- Category
- Trigger Abuse
- Confidence
- 84% confidence
- Finding
The trigger
줄여('shorten') is very short and generic, making accidental activation likely in unrelated conversations. In this skill's context, unintended activation is more concerning because it can lead to external network requests involving user URLs, increasing privacy risk.- Content
Static analysis
No suspicious patterns detected.