Creator Course Outline

• Outcome: Pass
• Latest audit: Sep 12, 2026 · 2:33 AM UTC
• Version: 1.0.0

Overview

This skill is a Chinese-language course-outline helper with a local Python formatter; it has some unused generic audit code, but the shipped configuration keeps execution aligned with course-outline generation.

Install this if you want a Chinese-language course-outline drafting helper and are comfortable with it optionally running a local Python script. Review the script before enabling shell execution in a high-trust workspace, and provide only course materials you are willing to have summarized into the generated output.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (13)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence
• Finding: 声明描述的是一个面向课程设计的内容生成工具，但实际代码并未体现课程模块、单元目标、作业或里程碑的专门生成逻辑。相反，它从 resources/spec.json 读取配置后，按 mode 执行通用审计或报告功能：扫描目录、抽样文本文件、统计扩展名、读取 CSV 字段、匹配危险 shell/secret/private URL 模式，以及检查 Skill 项目必需文件和 SKILL.md frontmatter。虽然其中的 structured_brief 模式可以把输入文本整理成分节报告，勉强可用于某些课程草案整理，但这只是通用模板化摘要能力，不足以支持“课程生成”这一主要声明。整体主用途与能力集合更接近本地审计/分析工具，而非创作者课程结构生成器，因此属于明显描述与行为不符。

Context-Inappropriate Capability

High

• Confidence: 97% confidence
• Finding: These helper functions implement broad repository and content-auditing features, including recursive file enumeration, markdown heading extraction, CSV sampling, regex-based secret/pattern scanning, and skill structure inspection. In the context of a course-outline skill, such latent capabilities are dangerous because they allow collection and reporting on unrelated local content, increasing the chance of sensitive data discovery or unintended exfiltration through generated output.

Description-Behavior Mismatch

High

• Confidence: 98% confidence
• Finding: The script’s main dispatch logic enables directory auditing, CSV inspection, pattern scanning, and skill auditing modes that materially exceed the declared purpose of generating creator course outlines. This mismatch is dangerous because a user or orchestrator may grant the skill access to local files under the assumption it only performs benign curriculum generation, creating an unnecessary data-exposure and capability-expansion risk.

Vague Triggers

Medium

• Confidence: 96% confidence
• Finding: The trigger examples are broad enough to match ordinary course-design requests without clearly stating when this skill should or should not activate. In a multi-skill or agentic environment, that can cause unintended routing to this skill, leading to inappropriate outputs, missed safeguards, or interference with more suitable skills.

Natural-Language Policy Violations

Medium

• Confidence: 94% confidence
• Finding: This markdown file presents all user-facing audit content in Chinese and does not indicate that the user can choose another language. Under the stated policy, forcing a specific language without user opt-in is a natural-language policy violation unless the locale restriction is explicitly justified.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 95% confidence
• Finding: The skill declares no explicit tool scope or permissions, yet its instructions reference local file resources and permit shell execution via `python3 .../scripts/run.py`. In a user-invocable skill, this creates an authorization ambiguity where an agent may read files, write outputs, or invoke a shell without a clearly constrained allowlist, increasing the chance of unintended filesystem access or command execution.

Natural-Language Policy Violations

Medium

• Confidence: 93% confidence
• Finding: The entire example output is written in Chinese and does not mention any option for the user to choose another language. Under the policy rule for natural-language violations, this appears to impose a specific language/locale without documented opt-in or justification.

Natural-Language Policy Violations

Medium

• Confidence: 92% confidence
• Finding: The title, category label, and summary are all specified only in Chinese, indicating the skill is designed to operate in a fixed language/locale. The file does not mention any user language choice, opt-in, or justification for restricting the skill to Chinese, which matches the language/locale policy violation criteria.

Natural-Language Policy Violations

Medium

• Confidence: 96% confidence
• Finding: Multiple user-facing report strings are emitted only in Chinese, such as section headers and guidance text, with no option to select language or locale. This creates a natural-language policy concern because the skill effectively forces a specific language on users without opt-in.

Description-Behavior Mismatch

Medium

• Confidence: 90% confidence
• Finding: The script can write reports to an arbitrary user-supplied output path, which expands its side effects beyond the manifest’s narrow content-generation description. While not intrinsically malicious, undocumented file-writing capability can be abused to overwrite project files or place scanned-content reports in sensitive locations when the skill is run with elevated trust.

Natural-Language Policy Violations

Low

• Confidence: 86% confidence
• Finding: All user-facing instructions and examples in the README are presented only in Chinese, which can amount to forcing a specific language without opt-in. There is no indication that the skill is intentionally region-specific or that users may choose another language.

Natural-Language Policy Violations

Low

• Confidence: 90% confidence
• Finding: The file’s title and all instructional content are written only in Chinese, with no indication that language selection is optional or that the skill is specifically limited to a Chinese-only context. Under the policy, a skill should not impose a specific language or locale without user opt-in or clear justification.

Natural-Language Policy Violations

Low

• Confidence: 94% confidence
• Finding: The template headings and instructions are entirely in Chinese, which implies the skill's output format is fixed to a specific language. Under the policy criteria, a skill should not force a language or locale unless it offers user choice or clearly documents a justified locale constraint.

Static analysis

No suspicious patterns detected.