Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 70% confidence
- Finding
Without declared permissions the skill's intent is opaque and cannot be validated.
- Content
Security audit
Lesson
Security checks for vulnerabilities and agentic risk
Overview
This is a coherent Chinese meal-planning skill with only local recipe data and no evidence of hidden access, networking, persistence, or destructive behavior.
Install this if you want a Chinese-language meal planner that uses bundled recipe data. Be aware that its triggers are broad and its helper script can overwrite a file if you explicitly pass an --output path, but I found no evidence of network access, credential use, persistence, or destructive behavior.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Vulnerability Patterns
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- Behavioral ASTexec() Call, eval() Call, Dynamic Import
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (8)
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The trigger phrases include very common conversational expressions like '今天吃什么' and '晚饭吃啥', which can cause the skill to activate in broad, everyday contexts where the user may not be explicitly requesting this skill. Overbroad activation can lead to unintended routing, context capture, or interference with other skills, especially in multi-skill environments.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
This JSON eval file is a manifest-like file, so SQP-3 applies. The prompts and expected outputs are consistently written in Chinese, which indicates the skill behavior is evaluated against a single forced language with no opt-in, alternative locale, or documented region-specific justification.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The manifest says the skill will output a '完整的菜单方案和分步烹饪指南', implying concrete per-dish cooking instructions. However, generate_menu only returns selected dishes, ingredient summaries, and a high-level timeline tip; there are no step-by-step preparation or cooking instructions stored or produced anywhere in the file.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 84% confidence
- Finding
The skill content is entirely written as Chinese-only interaction guidance and does not indicate that users may choose another language. Under the policy, forcing a specific language without opt-in can be a natural-language policy violation unless the locale restriction is clearly documented and justified.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The entire skill reference is written in Chinese and assumes Chinese ingredient names, aliases, and cooking terminology throughout. There is no indication that users may opt into another language or locale, which can violate a language/locale policy when such constraints are imposed without user choice.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The entire markdown file is written in Chinese and presents the recipe database only in that language, with no indication that users can choose another language or that the skill is intentionally limited to a Chinese-speaking context. This is a natural-language locale constraint that may violate organizational language-choice policy when no opt-in or justification is provided.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
This code file contains user-facing natural-language documentation and CLI help centered entirely in Chinese, starting with the module docstring examples and continuing through the interface text. Under the policy, forcing a specific language without user opt-in can be a natural-language policy violation when no alternative language or justification is provided.
- Content
Static analysis
No suspicious patterns detected.