Security audit

mifu-chemistry-lesson-prep

Security checks for vulnerabilities and agentic risk

Overview

This is a Chinese chemistry lesson-prep skill made of markdown instructions, with no code, persistence, credential use, or hidden system changes found.

Install this if you want Chinese-language chemistry lesson-prep support in the MiFu/China-exam style. Users outside that educational context should expect to adapt the language, curriculum, and regional exam assumptions, especially because non-Shanghai adapters are mostly skeletal.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (12)

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The README is entirely written as a Chinese-only skill description and presents the skill as producing lesson materials for Chinese educational contexts without any indication that users may choose another language or locale. Under the policy rule, a skill that effectively enforces a specific language without opt-in should be flagged unless the locale restriction is explicitly documented and justified.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The trigger condition is overly broad: any request about chemistry lesson plans, study guides, topic refinement, or single-lesson design may invoke the skill without tight scoping or explicit user consent. In a multi-skill agent, this can cause inappropriate auto-activation, leading the agent to apply hidden internal workflows, assumptions, or constrained outputs when the user only asked a general chemistry question.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The skill hardcodes Chinese-language and China-specific expression conventions as part of its required workflow, without checking the user's preferred language or locale. This can override user intent, reduce usability for non-Chinese users, and cause the agent to produce inaccessible or mismatched output even when the educational content itself is otherwise safe.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The title and all instructional content are written exclusively in Chinese, which indicates a fixed language requirement. The file does not offer an alternative language option or explain that the skill is intentionally limited to a Chinese-speaking or region-specific context.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The title and framing prescribe a Chinese-only SOP for instruction, notes, and learner outputs, and the rest of the file continues with that assumption. Because the document does not offer any user language choice or justify a locale-specific restriction, it appears to enforce a specific language by default.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The entire skill file is written in Chinese and does not indicate that the user may choose another language or that the Chinese-only presentation is required for a region-specific or compliance-related purpose. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The entire skill reference is written as mandatory Chinese phrasing guidance, including directives such as memorizing standard scoring sentences and using prescribed answer formulations. There is no indication that language choice is optional or that the locale restriction is explicitly justified as a region-specific tool, which fits the language/locale policy violation criteria.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The entire skill content is written in Chinese and presents its guidance solely in that language, with no indication that users may choose another language or locale. Under the stated policy, forcing a specific language without user opt-in is a natural-language policy violation.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: This markdown file uses Chinese throughout and does not provide any indication that users may choose another language or that the language restriction is an explicit opt-in. Under the policy rule for language or locale constraints, forcing a specific language without user choice can be a natural-language policy violation.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The title and the entire document are written exclusively in Chinese, and there is no indication that users may choose another language or locale. Under the policy rules, forcing a specific language without opt-in is a natural-language policy violation unless the locale restriction is explicitly justified.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 86% confidence
Finding: The prompt explicitly instructs the AI to act as a "上海高考化学阅卷专家," which hard-codes a specific regional/locale context. Under the policy, locale constraints should either be optional or clearly justified as region-specific tooling; here the prompt is presented as a reusable template without user choice.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 86% confidence
Finding: The text requires the AI to respond as a "上海高考化学阅卷老师," which imposes a specific locale and assessment standard. Because the file does not offer opt-in or alternatives, this can violate the language/locale policy for broader users.
Content: No source excerpt is available for this finding.