Tp2
High
- Category
- MCP Tool Poisoning
- Confidence
- 85% confidence
- Finding
Mixing characters from multiple Unicode scripts in a single identifier is a common technique to create visually ambiguous tool names.
- Content
Security audit
Skill Product
Security checks for vulnerabilities and agentic risk
Overview
This skill is a disclosed product-description writing helper that uses a third-party API and optional local output storage, with no executable payload or hidden privileged behavior found.
Install only if you are comfortable providing a TRADEGPT_API_KEY and sending product, SEO, and competitor-comparison inputs to Yunlv's TradeGPT API. Review or delete any generated files under ./data/yunlv-skills/productDesc/ if the content is commercially sensitive, and manually confirm the skill is relevant when a broad term like SEO triggers it.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Vulnerability Patterns
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (7)
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The trigger list includes broad terms such as 'SEO', '差异化', and 'product description' that can match many unrelated requests, causing this skill to activate outside its intended scope. Over-broad activation increases the chance that user data is routed into an external API workflow or persisted locally when the user did not intend to use this specialized skill, creating privacy, consent, and prompt-routing risks.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 87% confidence
- Finding
The trigger term "差异化" is ambiguous and generic, so it may invoke the skill for many requests unrelated to product descriptions. In this skill, that increases the risk of misrouting user tasks and sending irrelevant prompts to the connected third-party content-generation API.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The trigger term "SEO" is overly broad and can match many unrelated user requests, causing the skill to activate outside its intended product-description scope. While this is not a direct code-execution issue, it can lead to inappropriate routing, unnecessary exposure of the skill, and accidental use of its external API in contexts the user did not intend.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The document is written entirely in Chinese and presents all reusable sales templates only in that language, with no indication that users may choose another language or that the skill is intended solely for a Chinese-speaking context. This creates a natural-language locale policy concern because it implicitly mandates one language without user opt-in or documented justification.
- Content
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The skill explicitly allows writing generated descriptions to local storage under './data/yunlv-skills/productDesc/' but does not clearly notify the user that their product information and generated content may persist on disk. Even if the data is not highly sensitive by default, product specs, unpublished copy, pricing-related differentiation, and competitor comparisons can be commercially sensitive, so silent persistence creates an avoidable confidentiality and retention risk.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
This markdown file contains user-facing instructional content exclusively in Chinese, with no indication that the skill supports other languages or that Chinese is a required locale. Under the language/locale policy rule, forcing a specific language without user opt-in can be a natural-language policy violation.
- Content