Security audit

音乐教育研究写作助手music-education-research-writer

Security checks for vulnerabilities and agentic risk

Overview

This skill is a disclosed academic writing helper that reads only user-provided research materials and includes no hidden execution, credential access, or persistence behavior.

Install this if you want a structured helper for music education research, especially Chinese academic writing contexts. Provide only the research folders or files you want analyzed, verify citations yourself, and ask for a different output language or non-China framing when needed.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (20)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The declared purpose is about academic research synthesis and scholarly writing support, but the actual code performs build/distribution tooling for a skill package. There is no functionality related to literature review generation, corpus synthesis, citation handling, educational research analysis, or writing assistance. The code’s primary purpose is materially different from the description, so this is a clear mismatch.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The declared purpose describes an end-user research-writing skill for synthesizing academic materials. The actual code does not implement literature review generation, theory/model construction, research gap analysis, citation handling, or corpus synthesis. Instead, it acts as an internal validator for the skill package, enforcing metadata/structure requirements and scanning for risky patterns. This is a materially different primary purpose from the declared description, so it is a clear mismatch.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The skill documentation is presented as Chinese-first and does not indicate that users may choose another language or locale. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation unless the locale restriction is clearly documented and justified.
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 70% confidence
Finding: Without declared permissions the skill's intent is opaque and cannot be validated.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 81% confidence
Finding: The skill states it helps with refinement for Chinese core-journal, CSSCI, or Peking University core-journal contexts, and elsewhere includes Chinese-only labels and China-specific framing as defaults in several procedures. While region-specific use cases are valid, the document does not clearly present these locale constraints as optional or ask the user to opt into Chinese-language/China-context handling before applying them.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 84% confidence
Finding: The document explicitly prioritizes Chinese core journals and publication-relevant evidence, which introduces a locale-specific constraint. Because the file does not clearly state that the skill is intended only for China-specific academic workflows or offer a user opt-in for this locale focus, it may violate the policy against forcing a specific language or locale without justification.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The required output sequence specifies Chinese-only section titles (综述结构表, 可直接扩写的综述段落, 引用与证据清单) without indicating that the user can choose another language. This creates a language/locale constraint in the skill instructions that may conflict with organizational policy requiring user choice or opt-in.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 87% confidence
Finding: The workflow requires checking for "China-context gaps" and uses Chinese-only output markers such as 需要补充的文献清单 and 待核验, which steers outputs toward a specific locale and language. Because the file does not present this as an explicit user opt-in or clearly justify it as a region-specific skill, it can violate language/locale policy expectations.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The phrase Chinese or domestic scholarship hard-codes a China/domestic perspective into the default review structure. In a generic template, this imposes a locale-specific framing without user opt-in or a documented reason that the template is intended only for that regional context.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The checklist explicitly rewards outputs that stay close to Chinese high-school classroom language and Chinese education context, which can steer the skill toward a locale-specific framing even when the user did not request it. In a research-writing skill, this creates a real alignment and bias risk: the model may overfit to a Chinese context, narrow applicable evidence, or generate culturally mismatched analysis for users working in other regions.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 80% confidence
Finding: This markdown file contains user-facing content such as 待核验 in an otherwise English document, and later uses additional Chinese verification labels. Under the language/locale policy rule, forcing or assuming a language without opt-in can be a natural-language policy issue when no justification or language selection is provided.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 85% confidence
Finding: Lines 150-153 include Chinese-only labels such as 部分核验 and 待核验 in a user-facing evidence table, but the file does not explain that the output is intended for Chinese-speaking users or offer a language choice. This creates a language/locale policy concern under the natural-language policy rule.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The table entry uses the Chinese label "待核验" while the rest of the file is in English, which introduces a language-specific element without user opt-in or explanation. Under the policy rule, forcing or inserting a specific language without choice can be a natural-language policy violation.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 78% confidence
Finding: The file requires use of Chinese labels such as '已核验', '部分核验', and '待核验' but does not provide an English alternative or indicate that the user has chosen Chinese output. This can amount to forcing a specific language in the skill's workflow.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 80% confidence
Finding: This code performs filesystem writes by creating the output directory and writing zip/skill archives, which falls under safety-relevant file write behavior for code files. While the script's purpose is packaging, the write operation itself lacks inline comment/docstring disclosure at the function level and relies only on generic CLI descriptions.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The template includes the Chinese label 待核验, which introduces a non-English output term without any opt-in or explanation. Because this is a general literature review template rather than a clearly region-specific tool, forcing mixed-language terminology can conflict with language/locale policy expectations.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The matrix includes a fixed "China-context gap" category, which imposes a specific regional framing in the template. Because the file does not offer a locale choice or explain that the template is intended for China-specific research, this can violate language/locale policy expectations.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 85% confidence
Finding: This markdown file includes natural-language status values such as '已核验', '部分核验', and '待核验' in Chinese while the surrounding document is otherwise in English. That imposes a specific language/locale on readers without any visible opt-in or explanation, which matches the language-policy category.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 86% confidence
Finding: The instruction "请用 Standard Mode。" imposes a specific mode/locale-style constraint in natural language without presenting it as an option or asking for user preference. Under the policy rule, forcing a language or locale-related setting without opt-in can be a natural-language policy violation.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 82% confidence
Finding: The sample request is entirely framed in Chinese and asks for output tailored to Chinese core journals and classrooms, which imposes a specific language/locale context without any opt-in or alternative. Under the policy rule, forcing a specific language or locale can be a natural-language policy violation unless clearly justified or optional.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.