Security audit

Language Learning Mastery

Security checks for vulnerabilities and agentic risk

Overview

This is a Markdown-only language tutoring skill with broad activation examples but no code, persistence, credential access, or unsafe authority.

Install this if you want a general conversational language tutor. Be aware that broad prompts like 'Quiz me' or 'I want to learn Spanish' may route into this skill in systems with automatic skill activation, and its claims about supporting every language should be treated as aspirational rather than guaranteed quality for all languages.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (3)

Vague Triggers

Medium

Confidence: 94% confidence
Finding: The quick-start phrases are extremely generic user utterances such as wanting to learn a language, asking for a conversation, requesting a quiz, or asking about progress. If this skill platform uses natural-language activation or routing, these broad triggers can cause unintended invocation during ordinary conversation, leading to misrouting, context hijacking, or accidental activation without clear user intent.

Vague Triggers

Medium

Confidence: 95% confidence
Finding: The skill exposes multiple natural-language activation phrases such as "Quiz me," "Give me homework," and especially broad phrasings like "I want to learn [language]" and "Explain [cultural thing]," which can overlap with ordinary conversation. In systems that auto-route based on fuzzy matching, this can cause unintended skill invocation, leading to context hijacking or unexpected handling of user input by this skill instead of the intended agent behavior.

Natural-Language Policy Violations

Low

Confidence: 76% confidence
Finding: The description strongly asserts universal language coverage in natural language, including "learn any human language" and later "Supports Every Language." While not an explicit forced locale, this broad language claim lacks qualification or user opt-in framing and could conflict with organizational expectations around clearly communicated language support limits.