Security audit

Student AI Agent

Security checks for vulnerabilities and agentic risk

Overview

This academic workflow skill is coherent, but it needs Review because broad prompts can lead to dependency installs and generated-code execution, while some promised submission-ready outputs are only templates.

Review before installing. Use only in a disposable project directory or sandbox, require confirmation before installing packages, writing outputs, or running generated code, avoid global npm installs, and do not treat generated academic deliverables as submission-ready without manual completion and review.

SkillSpector

Vulnerability Patterns

Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (11)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 85% confidence
Finding: The skill clearly instructs reading user assignment inputs and writing multiple local output artifacts, yet it does not declare corresponding permissions. Undeclared file capabilities reduce transparency and can lead to the agent performing filesystem actions users or platform controls did not explicitly authorize.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 96% confidence
Finding: The skill advertises an end-to-end workflow producing submission-ready deliverables, but the analyzed behavior reportedly emits placeholder templates and does not perform the promised execution steps. This mismatch is dangerous because it can mislead users into trusting incomplete or fabricated outputs, especially in an academic context where correctness and provenance matter.

Context-Inappropriate Capability

Medium

Confidence: 89% confidence
Finding: Automatically installing missing Python and Node dependencies expands the skill from document generation into package management and environment modification. That creates avoidable supply-chain and system-integrity risk, especially if package names or install commands are influenced by task content or run without user confirmation.

Context-Inappropriate Capability

High

Confidence: 94% confidence
Finding: The skill directs the agent to execute generated code and local scripts via shell commands, which introduces general code-execution capability. Because some executed content is generated from user-supplied assignment material, this raises the risk of command injection, unsafe script execution, or running unreviewed code on the host environment.

Description-Behavior Mismatch

Medium

Confidence: 94% confidence
Finding: The skill metadata and workflow messaging promise a fully automated, submit-ready academic deliverable pipeline, but the implementation only emits templates, JSON scaffolding, and a placeholder code file. In this context, the mismatch is security-relevant because it can materially deceive users about the level of completion and verification performed, encouraging unreviewed submission of fabricated or incomplete work.

Intent-Code Divergence

Medium

Confidence: 92% confidence
Finding: The top-level docstring and step labels assert code verification, report generation, PPT creation, and Q&A simulation, but the functions only write placeholder structures and unchecked checklists. Because this is an academic-submission skill, the misleading automation claim increases the risk that users will trust nonexistent validation and submit inaccurate, unreviewed, or noncompliant artifacts.

Vague Triggers

Medium

Confidence: 95% confidence
Finding: The documented trigger phrases are very broad, including common conversational phrases like 'assignment', 'homework', and '帮我做'. In a chat-based agent environment, this can cause the skill to activate during ordinary discussion and initiate a high-impact workflow that generates substantial academic deliverables without clear confirmation.

Missing User Warnings

Medium

Confidence: 97% confidence
Finding: The README advertises one-shot execution of a 7-step workflow that writes code, reports, slides, notes, and Q&A materials, but the user-facing description does not clearly warn that multiple project files will be created automatically. This reduces informed consent and increases the risk of unexpected file generation or overwriting in environments where users may think they are only asking for analysis or advice.

Vague Triggers

Medium

Confidence: 88% confidence
Finding: The trigger phrases are broad and overlap with ordinary user requests like 'assignment' or 'homework,' increasing the chance of accidental invocation. In this skill, accidental activation is more concerning because the workflow includes writing files, installing dependencies, and executing scripts.

Vague Triggers

Medium

Confidence: 84% confidence
Finding: The invocation examples define loose activation conditions like 'help me do it' without boundaries, which can cause the skill to engage on ambiguous requests. Given the powerful downstream actions described, ambiguous routing increases the risk of unintended file creation or code execution.

Overly Broad Trigger

Low

Category: Trigger Abuse
Confidence: 80% confidence
Finding: Using a very short trigger like '作业' makes unintended activation likely because it can appear in many normal conversations. While the trigger alone is low severity, it becomes riskier here because activation may lead to a broad automated workflow with file and execution side effects.

Static analysis

No suspicious patterns detected.