Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 70% confidence
- Finding
Without declared permissions the skill's intent is opaque and cannot be validated.
- Content
Security audit
nihao
Security checks for vulnerabilities and agentic risk
Overview
This is a straightforward Chinese-language meal-planning skill with local recipe data and no hidden network, credential, persistence, or unsafe install behavior.
Install this if you want a Chinese-language cooking assistant. Be aware it may activate on broad meal/menu phrases and the optional script can save generated menu JSON to a path if invoked with --output; review recipe advice for allergies, dietary restrictions, and food-safety needs.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Vulnerability Patterns
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (6)
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The trigger phrases include broad everyday expressions such as '今天吃什么', '做什么菜', and '菜单', which can cause the skill to activate in conversations where the user did not intend to invoke it. Over-broad activation increases the chance of unintended context capture, response hijacking of unrelated requests, and poor routing behavior across the assistant.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The entire skill file is written in Chinese, including the title, category labels, ingredient names, and operational notes, with no indication that users can choose another language or that the skill is intentionally limited to a Chinese-language audience. This creates a natural-language policy concern because it effectively imposes a locale/language constraint without opt-in or explicit justification.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The entire markdown file presents the skill content exclusively in Chinese, including the title, headings, and instructions, without offering any language choice or stating that the skill is intentionally limited to Chinese-speaking users. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The module docstring, CLI examples, argument help text, and style choices are entirely in Chinese, presenting the skill as Chinese-only with no user opt-in or alternative locale support. Under the policy for natural-language violations, this is a locale/language constraint that is not documented as region-specific or optional.
- Content
Description-Behavior Mismatch
Low
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The manifest describes a recommendation skill that outputs menu plans and step guidance based on ingredients and preferences. In addition to generating recommendations, the script accepts an --output path and writes JSON to disk via Path(args.output).write_text(), which is a side effect not reflected in the skill description.
- Content
Static analysis
No suspicious patterns detected.