Tp2
High
- Category
- MCP Tool Poisoning
- Confidence
- 85% confidence
- Finding
Mixing characters from multiple Unicode scripts in a single identifier is a common technique to create visually ambiguous tool names.
- Content
Security audit
Policy Sea
Security checks for vulnerabilities and agentic risk
Overview
This skill is a straightforward Southeast Asia trade-policy reference helper with no executable code, persistence, credential access, or hidden high-impact behavior in the inspected artifacts.
Before relying on this skill for business decisions, verify important tariff, certification, and customs answers against official government or customs sources because the skill itself says it is not formal legal advice and the artifact does not show its live data-source implementation.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Vulnerability Patterns
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (3)
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
The description says users can ask about Southeast Asian tax, certification, and market-entry topics in a very open-ended way ('一问全出'), but it does not define specific trigger phrases, scope boundaries, or exclusion conditions. In a manifest/markdown context, this can cause ambiguous activation because the skill appears callable from many ordinary trade-related questions.
- Content
Vague Triggers
Low
- Category
- Not specified by scanner
- Confidence
- 81% confidence
- Finding
The text implies the skill activates whenever a user asks a trade-policy question like '泰国电子零部件关税', but it does not specify the exact scope, required context, or cases where the skill should not be used. This leaves trigger behavior underspecified for a markdown skill description.
- Content