Security audit

study-revision-planner

Security checks for vulnerabilities and agentic risk

Overview

This is a local study-planning skill with no hidden network, credential, persistence, or privilege behavior, though its helper script is simpler than the full planning features described.

This skill is reasonable to install for drafting study plans. Before relying on it, understand that the bundled script only creates a basic topic/date CSV and does not itself implement the full spaced-review or mock-test workflow; review generated plans and avoid pointing the script at sensitive files unless needed.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration

Findings (8)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 97% confidence
Finding: The skill promises capabilities such as syllabus ingestion, spaced review, mock tests, and weak-point loops, but the detected behavior reportedly does not implement them. This can mislead users and downstream agents into trusting outputs that appear pedagogically complete when key planning logic is absent, causing incorrect study plans or unsafe automation assumptions about what the script actually did.

Natural-Language Policy Violations

Medium

Confidence: 93% confidence
Finding: This skill description contains substantial natural-language guidance in Chinese (for example section headers and usage guidance) while other parts are in English, but it does not state that the skill is Chinese-only, bilingual by design, or that users may choose their preferred language. That can create an implicit language policy constraint without user opt-in, which falls under the language/locale policy rule.

Lp3

Medium

Category: MCP Least Privilege
Confidence: 70% confidence
Finding: Without declared permissions the skill's intent is opaque and cannot be validated.

Description-Behavior Mismatch

Medium

Confidence: 95% confidence
Finding: The manifest says the skill converts study inputs into a revision calendar with spaced review, mock tests, and weak-point loops. This code only distributes topics linearly across the available days and writes a single "learn" phase entry per topic, with no logic for repeated reviews, mock exams, or adaptive weak-point remediation.

Natural-Language Policy Violations

Low

Confidence: 93% confidence
Finding: This markdown file contains natural-language instructions and conclusions exclusively in Chinese, and there is no indication that the skill is region-specific or that users may choose another language. Under the policy rule for language/locale constraints, forcing a specific language without opt-in is a natural-language policy concern.

Natural-Language Policy Violations

Low

Confidence: 83% confidence
Finding: The trigger list and suggested prompts include Chinese-only phrases such as "复习计划" and "课程大纲变计划" alongside English triggers, but the skill does not state whether users may choose their preferred language for interaction or output. This can create an implicit locale/language constraint without explicit opt-in.

Natural-Language Policy Violations

Low

Confidence: 87% confidence
Finding: The document title and request framing are in Chinese, while the expected trigger phrases, inputs, and deliverables are partly in English. This can imply a language preference or default output style without explicitly offering the user a language or locale choice, which matches the policy concern for forced language behavior.

Natural-Language Policy Violations

Low

Confidence: 85% confidence
Finding: The file’s instructional content from the section headings onward is written in Chinese, while some checklist items remain in English. This may indicate a language preference being imposed without explicitly offering the user a language choice or documenting a justified locale constraint.

Static analysis

No suspicious patterns detected.