Tp2
High
- Category
- MCP Tool Poisoning
- Confidence
- 85% confidence
- Finding
Mixing characters from multiple Unicode scripts in a single identifier is a common technique to create visually ambiguous tool names.
- Content
Security audit
Yunlv Pod Agent
Security checks for vulnerabilities and agentic risk
Overview
This POD advice skill is mostly coherent, but some materials encourage automatic refunds and address changes without enough safeguards.
Review this carefully before installing. The skill itself does not appear to contain malicious code or hidden persistence, but only use it for advice unless you have strong controls around any store automation. Do not enable automatic refunds, address changes, listing changes, or customer-data access without customer verification, least-privilege permissions, audit logs, limits, and human approval for nontrivial cases.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Vulnerability Patterns
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (15)
Tp2
High
- Category
- MCP Tool Poisoning
- Confidence
- 85% confidence
- Finding
Mixing characters from multiple Unicode scripts in a single identifier is a common technique to create visually ambiguous tool names.
- Content
Tp2
High
- Category
- MCP Tool Poisoning
- Confidence
- 85% confidence
- Finding
Mixing characters from multiple Unicode scripts in a single identifier is a common technique to create visually ambiguous tool names.
- Content
Tp2
High
- Category
- MCP Tool Poisoning
- Confidence
- 85% confidence
- Finding
Mixing characters from multiple Unicode scripts in a single identifier is a common technique to create visually ambiguous tool names.
- Content
Tp2
High
- Category
- MCP Tool Poisoning
- Confidence
- 85% confidence
- Finding
Mixing characters from multiple Unicode scripts in a single identifier is a common technique to create visually ambiguous tool names.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 76% confidence
- Finding
Most descriptive and instructional text is written exclusively in Chinese, and the invocation examples are primarily Chinese phrases, but the file does not state that language selection is optional. This can violate a language/locale policy when users are not given an explicit opt-in or alternative language path.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 85% confidence
- Finding
The trigger set includes broad business phrases such as '上架建议' and generic POD/AI terms that could activate the skill for ordinary e-commerce questions outside the user's intent. Over-broad activation can cause unintended routing to an external-API-backed skill, increasing the chance of unnecessary data exposure in prompts and of receiving domain-specific advice when a general answer was expected.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
The trigger list includes generic business phrases such as '上架建议' and broad POD/e-commerce terms that can match routine store-optimization or listing questions, causing the skill to activate outside a clearly intended scope. In an agent ecosystem, over-broad activation can route users to an external API and specialized advice flow unnecessarily, increasing the chance of irrelevant guidance, privacy over-sharing, or unintended tool use.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The article explicitly promotes an AI客服 reaching 'L4' capability to directly execute refunds and address changes, framing this as a benefit without requiring human approval, guardrails, or discussion of privacy/financial risks. In a POD business context, these actions touch customer PII and can cause irreversible losses, fraud exposure, mistaken refunds, or unauthorized order modifications if the agent is wrong or manipulated.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The rollout guide tells users to '设置自动退款/查单规则' as a normal deployment step, but omits warnings about irreversible financial actions, customer-data handling, abuse scenarios, or the need for controls. Because this is operational guidance inside a business-automation skill, users may implement unsafe autonomous refund flows that can be exploited through prompt manipulation, policy misconfiguration, or false positives.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The checklist explicitly recommends configuring AI customer service to automatically execute refunds and address changes, but it does not require guardrails such as customer re-authentication, approval thresholds, audit logging, or clear user warnings. In a POD store context, these actions directly affect orders, payments, and customer data, so unsafe automation can cause unauthorized refunds, shipment tampering, fraud, and privacy violations.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
This Python skill's user-facing description and command help are written entirely in Chinese, with no indication that other languages are supported or that the user can choose their preferred locale. Under the policy, forcing a specific language without opt-in is a natural-language policy violation.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 77% confidence
- Finding
The manifest presents invocation language in both Chinese and English, but does not state whether the skill responds in a particular language or lets the user choose. If the skill defaults to one language or locale, the absence of an explicit language-choice policy may conflict with organizational expectations around user language preference.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The file title and all instructional content are written exclusively in Chinese, with no indication that language selection is optional or that the skill is specifically intended for a Chinese-speaking audience. Under the stated policy, forcing a specific language without user opt-in can be a natural-language policy violation.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
This markdown file contains only Chinese-language headings and descriptions, which can impose a language constraint on users without opt-in. Under the policy, forcing a specific language without user choice or clear justification is a natural-language policy concern.
- Content