MCP tool poisoning (Unicode deception / parameter injection)
ID |
mcp-tool-poisoning |
Severity |
low |
Remediation Complexity |
trivial |
Remediation Risk |
low |
Remediation Effort |
low |
OWASP LLM |
LLM01:2025 — Prompt Injection |
Family |
LLM01 — Prompt Injection |
Red-team vectors |
Prompt Injection, Indirect Injection |
Tags |
ai_security |
Description
Deceptive skill / tool metadata can steer an LLM without the user noticing. This detector inspects the manifest front-matter (name, description, and parameters[]) for:
-
TP2 — Unicode deception: an identifier that mixes Latin with Cyrillic/Greek look-alike letters (a homoglyph disguise — e.g. a Cyrillic
оinside an otherwise-Latin name), or any metadata field carrying invisible / bidirectional-override characters (zero-width, soft-hyphen, RTL/LRO overrides) that hide or reorder the text the model reads; -
TP3 — parameter-description injection: an instruction-injection marker (
SYSTEM:,ignore previous,you must,<system>…) inside a parameter description or default value — metadata the LLM reads and may act on.
TP1 (hidden instructions such as base64 blobs or HTML comments) is already covered by obfuscation-keyword-in-prompt plus the Stage-2 semantic review, and TP4 (description-behavior mismatch) is a Stage-2 semantic judgement — the same split SkillSpector uses.
| TP2 rests on exact Unicode character properties (language-agnostic) and keeps the default (medium) confidence; TP3 is an English-only natural-language marker and ships at low confidence. The severity is a low floor; the Stage-2 semantic review escalates confirmed true positives. |