Tp2
High
- Category
- MCP Tool Poisoning
- Confidence
- 85% confidence
- Finding
Mixing characters from multiple Unicode scripts in a single identifier is a common technique to create visually ambiguous tool names.
- Content
Security audit
Meta Control - Agent Orchestration
Security checks for vulnerabilities and agentic risk
Overview
The skill is a disclosed sub-agent orchestrator, but it gives broad background execution and monitoring authority without clear user approval or scope limits.
Install only if you want a Chinese-language orchestration skill that can delegate work to background sub-agents. Before using it on sensitive projects, require explicit confirmation for web crawling, script execution, automation, monitoring, file changes, credential use, and any long-running background task.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (5)
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The skill explicitly describes spawning background sub-agents, including an '执行 Agent' that can run scripts and automation, while emphasizing that the main agent will continue chatting and only report back when needed. This creates a risk of impactful actions being taken without clear user awareness, real-time confirmation boundaries, or disclosure of what sub-agents are permitted to do.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 87% confidence
- Finding
The description states that the skill acts as a master controller that dispatches sub-agents for background operations, but it does not define when this authority should be invoked or what boundaries apply. In an orchestrator skill, unclear activation and scope can cause over-broad delegation, unintended autonomous actions, or privilege expansion through downstream sub-agents.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
SQP-3 applies to all file types and includes language or locale policy violations. The skill description and instructions are entirely in Chinese, which can implicitly force a specific language experience without user opt-in or an explanation that the skill is intended only for a Chinese-language context.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 76% confidence
- Finding
The skill name and description are presented only in Chinese, with no indication that users can choose another language or that the skill is region-specific. This may violate language/locale policy if the organization requires user language choice rather than implicitly enforcing a single language.
- Content
Static analysis
No suspicious patterns detected.