Tp2
High
- Category
- MCP Tool Poisoning
- Confidence
- 85% confidence
- Finding
Mixing characters from multiple Unicode scripts in a single identifier is a common technique to create visually ambiguous tool names.
- Content
Security audit
Yunlv Product Desc
Security checks for vulnerabilities and agentic risk
Overview
This product-description skill is mostly purpose-built, but broad triggers and ambiguous retention disclosures could expose proprietary product or competitor data to an external API unexpectedly.
Install only if you are comfortable sending product details, draft listings, and optional competitor descriptions to YunlvAI's TradeGPT API. Use it for explicit B2B/export product-description tasks, avoid invoking it for generic SEO or marketing conversations, and review local generated output/log folders for retention expectations.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (8)
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The trigger list contains broad terms such as 'SEO', '差异化', and '产品页面' that can match many ordinary conversations unrelated to this skill's intended scope. Over-broad activation can cause the wrong skill to engage, increasing the chance that sensitive business content, draft copy, or competitor information is sent to the external API unnecessarily.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 84% confidence
- Finding
The skill advertises multilingual generation and translation but does not clearly require the user's language choice or opt-in before producing or sending content for translation. In a skill that may process proprietary product descriptions and competitor data through a third-party API, implicit language handling can lead to unnecessary disclosure, unexpected processing, or output in the wrong language for the user's business context.
- Content
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The skill states that generated product descriptions are 'not stored, not shared' while also declaring a local storage path for generated outputs and logs. This inconsistency can mislead users and operators about actual data handling, causing accidental retention of proprietary product data, competitive intelligence, or customer-specific content under a false expectation of non-storage.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The trigger list includes broad terms such as "SEO", "差异化", and "product description" that can match many unrelated user requests, increasing the chance this skill is invoked outside its intended scope. Over-broad invocation can route user data or prompts to an external API unnecessarily, causing unintended data exposure, irrelevant tool use, or prompt-surface expansion.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
This markdown file contains instructional content exclusively in Chinese, and there is no indication that users may choose another language or that the content is intentionally limited to a Chinese-speaking region or audience. Under the policy, forcing a specific language without user opt-in can be a natural-language policy violation.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
This code file includes natural-language descriptions, command help, and output labels that are effectively fixed to Chinese. The policy requires flagging language or locale constraints when the skill forces a specific language without user opt-in, and no alternative language option or justification is provided here.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 81% confidence
- Finding
This markdown file is primarily titled and structured in Chinese, but the reusable user-facing templates are written exclusively in English. That can amount to a language/locale policy issue if the skill implicitly forces English output without user opt-in or an explicit choice.
- Content
Static analysis
No suspicious patterns detected.