Tp2
High
- Category
- MCP Tool Poisoning
- Confidence
- 85% confidence
- Finding
Mixing characters from multiple Unicode scripts in a single identifier is a common technique to create visually ambiguous tool names.
- Content
Security audit
FB 专业内容生成
Security checks for vulnerabilities and agentic risk
Overview
This is a disclosed Facebook marketing copywriting skill with no executable code, persistence, credential use, or hidden data access.
Install this if you want a FridayParts-focused Facebook post drafting prompt. Review the configured model before use, and consider narrowing the triggers or adding an override if you need non-English or non-Facebook content.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Vulnerability Patterns
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (17)
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The entire skill description is written in Chinese and presents usage instructions only in Chinese, with no indication that users may choose another language or that the skill is intentionally limited to a Chinese-speaking audience. Under the stated policy, forcing a specific language without user opt-in is a natural-language policy violation.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
The 'Use when' description is broad and overlaps with common copywriting tasks, which increases the chance the agent invokes this skill outside its intended Facebook-only scope. That can lead to inappropriate instruction precedence, language forcing, or brand-specific messaging appearing in contexts the user did not request.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The trigger set and usage guidance are broad enough that the skill may activate for loosely related requests, causing unintended prompt injection of this skill's instructions into unrelated conversations. While this is not direct code execution, overbroad activation can degrade intent routing, override user expectations, and cause accidental disclosure of internal brand instructions into normal outputs.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The instruction "全部英文输出" mandates a specific language regardless of the user's preference. This is a language policy concern because the skill does not offer a choice or require user opt-in before forcing English output.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The hard rule "全部英文" enforces English for all outputs with no user choice. Even if English is operationally useful for the intended audience, the file does not present it as a default or optional setting, which violates the language/locale policy criteria.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
This markdown file presents example outputs for Facebook posts entirely in English while the surrounding instructions are in Chinese, indicating a fixed output language. Under the policy, forcing a specific language without offering the user a language or locale choice is a natural-language policy violation.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
Line L06 states '全英文，符合北美专业受众' ('all English, suitable for North American professional audience') as a fixed requirement. This is a natural-language locale policy constraint that appears mandatory and does not offer the user any language or locale choice.
- Content
External Model or Provider Selection
Medium
- Category
- Excessive Agency
- Confidence
- 90% confidence
- Finding
Skill selects an external model or provider that may use a different account or billing plan than the operator expects. Undisclosed model switches can cause unexpected cost or quota consumption.
- Content
md KOL合作推广、热点借势营销。每条输出含正文 + hashtag + 配图建议。 技术类内容自动保留"留余地"表述，客评 quote 自动控制在15词内。 Use when: 写 Facebook 帖子 / 客评转发 / 科普文案 / KOL推广文案 / 热点营销。 model: claude-sonnet-4-6 temperature: 0.7 max_tokens: 800 triggers:
External Model or Provider Selection
Medium
- Category
- Excessive Agency
- Confidence
- 90% confidence
- Finding
Skill selects an external model or provider that may use a different account or billing plan than the operator expects. Undisclosed model switches can cause unexpected cost or quota consumption.
- Content
md KOL合作推广、热点借势营销。每条输出含正文 + hashtag + 配图建议。 技术类内容自动保留"留余地"表述，客评 quote 自动控制在15词内。 Use when: 写 Facebook 帖子 / 客评转发 / 科普文案 / KOL推广文案 / 热点营销。 model: claude-sonnet-4-6 temperature: 0.7 max_tokens: 800 triggers:
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The manifest trigger list includes the single word "facebook", which is a common term that can appear in many unrelated conversations. Without context constraints or negative examples, this trigger is overly broad and may activate the skill when a user is discussing Facebook generally rather than requesting post generation.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 84% confidence
- Finding
The trigger "客评" is short and generic, and could match many ordinary references to customer reviews rather than a request to use this specific skill. The file does not provide exclusion conditions or contextual limits to distinguish when the skill should versus should not activate.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The instruction "全部英文输出" forces a specific language for all outputs. This is a natural-language policy concern because the skill does not offer the user a language choice or explicit opt-in before enforcing the locale constraint.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The hard rule "全部英文" reinforces a mandatory language restriction in the skill behavior. Because no opt-in or alternative locale path is provided, this constitutes a language policy issue rather than a merely stylistic preference.
- Content
Overly Broad Trigger
Low
- Category
- Trigger Abuse
- Confidence
- 82% confidence
- Finding
The trigger '客评' is extremely short and generic, making unintended activation plausible whenever users mention customer reviews in unrelated contexts. This can misroute conversations into this skill, causing unwanted brand-specific output or instruction interference even when the user did not ask for Facebook post generation.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
This markdown file presents all user-facing instructions exclusively in Chinese, which can amount to a language-policy issue when no alternative language option or explicit opt-in is provided. The rule allows locale constraints when clearly documented and justified, but this file does not state that the skill is intended only for Chinese-speaking users or a region-specific workflow.
- Content
Vague Triggers
Low
- Category
- Not specified by scanner
- Confidence
- 79% confidence
- Finding
"科普文案" describes a broad content type rather than a narrowly scoped invocation for this skill. Because the manifest does not limit the phrase to Facebook content or FridayParts brand usage, the trigger could match unrelated educational copywriting requests.
- Content
Static analysis
No suspicious patterns detected.