408 考研专属辅导 · Feynman × Ebbinghaus

• Outcome: Pass
• Latest audit: Jul 14, 2026 · 3:54 AM UTC
• Version: 1.0.0

Overview

This is a disclosed exam-tutoring skill that searches a specific study knowledge base and keeps study progress notes, with no evidence of deception, exfiltration, or destructive behavior.

Install this only if you want the tutor to use your 408 study knowledge base and maintain ongoing study summaries, weak-point tracking, and review reminders. Avoid sharing sensitive personal information during tutoring, and disable or avoid the skill if you need purely one-off, non-persistent Q&A.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (8)

Vague Triggers

Medium

• Confidence: 74% confidence
• Finding: The trigger text is broad enough that the skill could activate on many general study or summary requests, causing unintended access to the user’s 408 knowledge base and unnecessary processing of study data. While not an exploit primitive by itself, over-broad activation increases the chance of privacy-impacting behavior occurring without clear user intent.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The skill promises automatic tracking, archiving, and review reminders tied to the user’s study history without any visible notice, consent flow, or retention boundary. This is dangerous because users may disclose learning weaknesses, schedules, and notes expecting ephemeral tutoring, while the skill silently turns that into ongoing profile data.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: The skill directs routine searches of the user’s knowledge base and fallback web search without warning the user that their prompts may drive retrieval from personal materials or external services. This can expose sensitive study documents or query context more broadly than the user expects.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: Mandating updates to a structured, user-specific knowledge index after each conversation creates continuous recordkeeping about the user’s performance and study progress with no warning. Persistent profiling of user behavior is risky even in an educational context because it accumulates sensitive personal patterns over time.

Ssd 3

Medium

• Confidence: 95% confidence
• Finding: The skill explicitly instructs collection and retention of conversation-derived knowledge to build a user-specific knowledge framework. This is dangerous because it turns normal tutoring interactions into long-lived behavioral records, which may contain sensitive academic history and inferred weaknesses, without clear safeguards or user control.

Ssd 3

Medium

• Confidence: 94% confidence
• Finding: Recording each Q&A into a session knowledge-increment list and updating an index creates systematic retention of user inputs across interactions. Even if intended to improve tutoring, this enlarges the privacy attack surface and may expose user-provided content through later summaries, indexing, or retrieval.

Ssd 3

Medium

• Confidence: 95% confidence
• Finding: A continuously updated, structured knowledge map tied to the user is a persistent learner profile. In context, this is more dangerous because the skill is designed to update it after every conversation, making comprehensive accumulation the default rather than an explicit user-chosen feature.

Ssd 3

Medium

• Confidence: 88% confidence
• Finding: Forcing summary and archival output at the end of every dialogue increases the chance that retained user information is surfaced, repeated, or exposed unnecessarily. Automatic archival also normalizes persistence without a consent checkpoint, which is especially risky when conversations may contain study plans, mistakes, and document-derived details.

VirusTotal

65/65 vendors flagged this skill as clean.

Static analysis

No suspicious patterns detected.