ClawHub
Back to skill

Security audit

中小学教师智能备课助手

Security checks for vulnerabilities and agentic risk

Overview

This is a lesson-prep generator, but it includes overbroad automatic actions, plaintext credential storage, and persistent agent-configuration changes that need review before installation.

Review before installing. Use only in a contained workspace, do not enter education-platform passwords unless the storage is changed to a secure credential manager, remove or narrow global memory shortcuts, require confirmation before downloads or deletion, and pin any MCP/npm dependency before enabling diagram integration.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (5)

T01 · Skill Instruction Hijacking

Error
Location
SKILL.md:24
Finding

Mandatory Instructions Override User Scope and Require Unsafe File Deletion

Content
View full analysis

Vulnerability Details

File Location: SKILL.md:24-28 and SKILL.md:67
Vulnerability Type: Agent instruction hijacking and unsafe destructive behavior
Risk Level: High

Vulnerable Source Excerpt

The following is an English rendering of the mandatory rules in the source:

markdown
### Mandatory Rules

- Complete-package generation: Regardless of what the user requests, always generate the complete package.
- Resource downloading: Reference resources must actually be downloaded; saving links alone is prohibited.
- File cleanup: Delete all `.py` and `.js` script files after generation.

A second output rule states:

markdown
- Generated scripts and process files must be deleted.

Technical Analysis

These instructions explicitly direct the Agent to disregard the scope of the user's request. A request for one lesson plan may therefore be expanded into presentation creation, document creation, network resource retrieval, HTML generation, and cleanup operations.

The instruction to delete all .py and .js files is particularly unsafe because it does not define:

  • A restricted cleanup directory
  • A per-run temporary directory
  • An allowlist of files created by the Skill
  • A requirement for user confirmation
  • A check preventing deletion of pre-existing project files

Although the bundled Python programs do not implement this broad deletion directly, SKILL.md is operational Agent instruction text. An Agent following the Skill can perform the deletion using available filesystem tools.

Attack Path

  1. A user activates the Skill and requests a limited artifact, such as one lesson plan.
  2. The Agent loads the mandatory rules from SKILL.md.
  3. The “regardless of what the user requests” rule expands the operation to a complete package.
  4. The Agent performs unrequested network downloads and creates additional executable or process files.
  5. During cleanup, the Agent ...[truncated 828 chars]
Remediation
View remediation

Remediation Suggestions

  1. Remove the instruction that overrides the user's requested scope.
  2. Generate only the artifacts explicitly requested by the user.
  3. Make network resource retrieval optional and require informed user approval.
  4. Replace broad extension-based cleanup with a per-run manifest of files created by the Skill.
  5. Create temporary files only under a dedicated directory such as .workbuddy/tmp/teaching-materials/[run-id]/.
  6. Resolve and validate every cleanup target before deletion.
  7. Refuse to delete any file outside the dedicated run directory.
  8. Require confirmation before deleting files not created during the current run.

T02 · Agent Memory Poisoning

Error
Location
INSTALL.md:54
Finding

Installation Instructions Claim Persistent Modification of Global Agent Memory

Content
View full analysis

Vulnerability Details

File Location: INSTALL.md:54-84
Vulnerability Type: Persistent Agent state modification
Risk Level: High

Vulnerable Source Excerpt

The following is an English rendering of the installation instructions:

markdown
After this Skill is installed, the system automatically adds the following
activation commands to the user's global memory.

Activation command configuration location:

{user-home}/.workbuddy/memory/CLAW.md

Configuration content, automatically added:

## Skill Shortcuts

- `tapl` -> Start the teaching preparation assistant
- `lesson preparation` -> Start the teaching preparation assistant
- `teaching assistant` -> Start the teaching preparation assistant
- `teaching` -> Start the teaching preparation assistant

Technical Analysis

The installation documentation states that rules are automatically written to the user's global Agent memory. This exceeds the minimum privileges required to generate teaching documents.

Global memory affects later sessions rather than only the current Skill invocation. Broad trigger terms such as teaching can route unrelated future requests to this Skill, including its mandatory download and cleanup behavior.

No bundled script implementing the claimed automatic memory update was found. This creates a documentation-to-implementation discrepancy, but the instruction remains security-relevant if the host Agent or installer follows it.

Attack Path

  1. The user or hosting Agent installs the Skill.
  2. Installation instructions are interpreted as authorization to modify the global memory file.
  3. Shortcut rules are written to .workbuddy/memory/CLAW.md.
  4. The modified rules persist after the current session ends.
  5. A later user prompt containing a broad trigger such as teaching activates this Skill.
  6. The Skill's scope-expansion, download, and cleanup instructions may then execute without the user intention ...[truncated 557 chars]
Remediation
View remediation

Remediation Suggestions

  1. Remove all claims or instructions for automatic global-memory modification.
  2. Register activation metadata through a Skill-local manifest instead of persistent user memory.
  3. Require explicit, informed confirmation before changing any global Agent state.
  4. Use narrow, unique trigger phrases rather than generic words such as teaching.
  5. Display the exact proposed memory change before applying it.
  6. Create a backup and provide a reliable uninstall or rollback procedure.
  7. Record which entries were added so only those entries can later be removed.

T09 · Insecure Skill Coding Practices

Error
Location
teaching_materials.py:172
Finding

Education-Platform Passwords Are Echoed and Stored in Plaintext

Content
View full analysis

Vulnerability Details

File Location: teaching_materials.py:103-112 and teaching_materials.py:172-196
Vulnerability Type: Insecure credential collection and storage
Risk Level: High

Vulnerable Code

The credential-saving logic is structurally equivalent to the following, with user-facing strings rendered in English:

python
def save_accounts(self, accounts_data):
    self.accounts_file.parent.mkdir(parents=True, exist_ok=True)

    try:
        with open(self.accounts_file, 'w', encoding='utf-8') as f:
            json.dump(accounts_data, f, ensure_ascii=False, indent=2)
        self.accounts = accounts_data
    except Exception as e:
        print(f"Failed to save account configuration: {e}")
python
username = input("Username: ").strip()
if not username:
    accounts_data[key] = {
        "name": platform["name"],
        "url": platform["url"],
        "username": "",
        "password": "",
        "description": platform["description"]
    }
    continue

password = input("Password: ").strip()

accounts_data[key] = {
    "name": platform["name"],
    "url": platform["url"],
    "username": username,
    "password": password,
    "description": platform["description"]
}

self.save_accounts(accounts_data)

The destination is initialized as:

python
self.accounts_file = (
    self.workspace
    / ".workbuddy"
    / "teaching-materials-accounts.json"
)

Technical Analysis

Passwords are collected using input(), which normally displays entered characters on the terminal. They are then serialized directly into a plaintext JSON file.

The file is created using the process's default permissions. The code does not enforce owner-only access, use encryption, call an operating-system credential manager, or prevent the account file from being included in workspace backups and synchronization.

Collecting credentials may suppor ...[truncated 1427 chars]

Remediation
View remediation

Remediation Suggestions

  1. Replace input() with getpass.getpass() for secret entry.
  2. Store credentials in the operating system's credential manager or keyring.
  3. Prefer OAuth, session tokens, or revocable short-lived access tokens over reusable passwords.
  4. Collect credentials only when an authenticated operation is explicitly requested.
  5. Clearly identify which platforms require authentication and allow users to skip all credential setup.
  6. If file storage is unavoidable, create the file with owner-only permissions and validate those permissions before reading it.
  7. Keep the credentials file outside synchronized project workspaces.
  8. Add the credentials path to relevant ignore and backup-exclusion rules.
  9. Never print, log, or include secrets in generated resource manifests.
  10. Provide a command to securely remove stored credentials.

T08 · Insecure Dependencies

Error
Location
integration_demo.md:90
Finding

Unpinned MCP Package Is Automatically Downloaded and Executed Through NPX

Content
View full analysis

Vulnerability Details

File Location: integration_demo.md:90-99
Vulnerability Type: Unsafe third-party dependency execution
Risk Level: High

Vulnerable Code

json
{
  "mcpServers": {
    "mcp-diagram-generator": {
      "command": "npx",
      "args": ["-y", "mcp-diagram-generator"]
    }
  }
}

Technical Analysis

The configuration launches an npm package through npx without specifying an exact version or integrity value. The -y option suppresses the normal confirmation step.

When the package is not already available locally, npx may retrieve it from the configured npm registry and execute it. The effective code can therefore change after this Skill has been audited. A compromised maintainer account, malicious package update, registry compromise, or dependency takeover could introduce arbitrary code.

The reference to ~/.workbuddy/mcp.json does not itself expose a credential. The primary risk is that a security-sensitive Agent configuration file is used to define an unpinned remote package execution path.

Attack Path

  1. The MCP configuration is added to ~/.workbuddy/mcp.json.
  2. The Agent attempts to start mcp-diagram-generator.
  3. npx -y resolves the package from the configured npm registry.
  4. The registry supplies the latest matching package rather than a reviewed immutable version.
  5. Package installation hooks or runtime code execute with the Agent user's privileges.
  6. A malicious package can read accessible files, alter Agent configuration, invoke network services, or execute additional commands.

Impact Assessment

A compromised package can execute arbitrary code with the privileges of the WorkBuddy process. Depending on those permissions, this may expose:

  • Workspace documents and generated teaching materials
  • Plaintext account credentials stored by this Skill
  • Agent configuration and memory files
  • Files accessible to the local use ...[truncated 278 chars]
Remediation
View remediation

Remediation Suggestions

  1. Pin the package to an exact reviewed version.
  2. Install it through a committed lockfile with integrity metadata.
  3. Remove -y so installation cannot occur without confirmation.
  4. Verify package publisher identity, release history, and source repository.
  5. Review package installation scripts and transitive dependencies.
  6. Prefer a preinstalled, locally reviewed executable over runtime package retrieval.
  7. Run the MCP server with restricted filesystem and network permissions.
  8. Do not expose credential files or global Agent memory to the MCP subprocess.
  9. Establish an explicit process for reviewing and approving dependency upgrades.

T09 · Insecure Skill Coding Practices

Error
Location
teaching_materials.py:245
Finding

Unsanitized Lesson Metadata Can Escape the Intended Output Directory

Content
View full analysis

Vulnerability Details

File Location: teaching_materials.py:245-269 and generator.py:59-65,119-124
Vulnerability Type: Path traversal and arbitrary file write
Risk Level: High

Vulnerable Code

python
def generate_folder_name(self, grade, unit, lesson_num, lesson_name):
    return f"{grade}_{unit}_{lesson_num}_{lesson_name}"

def create_course_folder(self, folder_name):
    course_dir = self.teacher_dir / folder_name
    course_dir.mkdir(parents=True, exist_ok=True)

    (course_dir / "reference-resources").mkdir(exist_ok=True)
    (course_dir / "reference-resources" / "images").mkdir(exist_ok=True)

    return course_dir

The second generator follows the same pattern:

python
def _build_folder_name(self, info: Dict) -> str:
    return (
        f"{info['grade']}_{info['unit']}_"
        f"{info['lesson_num']}_{info['lesson_name']}"
    )
python
folder_name = self._build_folder_name(info)
output_dir = self.teacher_dir / folder_name
output_file = output_dir / f"{info['lesson_name']}_courseware.pptx"
temp_json = output_dir / "slides_data.json"

Technical Analysis

User-controlled values such as grade, unit, lesson number, and lesson name are inserted directly into directory and file paths. The code does not:

  • Reject path separators
  • Reject .. traversal components
  • Reject absolute paths
  • Normalize and validate resolved paths
  • Confirm that the final path remains under MyTeacher
  • Restrict filenames to a safe character set

Because several fields are concatenated, exploitation depends on the supplied values and operating-system path syntax. However, separator and traversal sequences can cause the resulting path to resolve outside the intended course directory. The lesson name is also used again as part of output filenames.

Attack Path

  1. An attacker controls or influences CLI arguments or lesson metadata.
  2. The attacker supp ...[truncated 1115 chars]
Remediation
View remediation

Remediation Suggestions

  1. Validate every user-controlled path component before use.
  2. Reject absolute paths, . and .. components, drive prefixes, null bytes, and both platform-specific path separators.
  3. Use a conservative allowlist for filenames, such as letters, numbers, spaces, underscores, and hyphens.
  4. Replace unsupported characters with safe placeholders.
  5. Resolve both the base directory and candidate output path before writing.
  6. Verify that every resolved output path is a descendant of the resolved MyTeacher directory.
  7. Apply the same validation to directory names and individual output filenames.
  8. Use exclusive file creation or explicit overwrite confirmation where practical.
  9. Add tests for traversal sequences, absolute paths, Windows drive paths, UNC paths, and mixed separators.
  10. Reject the operation if containment cannot be proven.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Findings (43)

Tp4

High
Category
MCP Tool Poisoning
Confidence
94% confidence
Finding

The second mismatch finding includes undeclared local credential storage for multiple education platforms, which is security-relevant because it introduces handling of sensitive secrets without clear disclosure or controls. Combined with promised automated login/download behavior, this increases the risk of credential misuse, unsafe storage, and unauthorized access patterns.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
95% confidence
Finding

The second mismatch finding includes undeclared local credential storage for multiple education platforms, which is security-relevant because it introduces handling of sensitive secrets without clear disclosure or controls. Combined with promised automated login/download behavior, this increases the risk of credential misuse, unsafe storage, and unauthorized access patterns.

Content

No source excerpt is available for this finding.

Vague Triggers

High
Category
Not specified by scanner
Confidence
95% confidence
Finding

The activation words include broad everyday phrases like '备课', '写教案', and 'teaching', making accidental or context-inappropriate invocation more likely. Because the skill is designed to perform network searches, downloads, file generation, and deletion, unintended activation can trigger impactful actions without clear user intent.

Content

No source excerpt is available for this finding.

Missing User Warnings

High
Category
Not specified by scanner
Confidence
95% confidence
Finding

The skill mandates automatic downloading of external resources and deletion of .py/.js files without requiring user warning or confirmation. This is dangerous because it combines untrusted content retrieval with potentially destructive local file operations, creating risk of data loss, supply-chain exposure, and removal of legitimate files in the workspace.

Content

No source excerpt is available for this finding.

Vague Triggers

High
Category
Not specified by scanner
Confidence
93% confidence
Finding

Allowing activation from only a topic name makes the trigger condition ambiguous and weakens intent verification. In this skill's context, that is dangerous because a simple lesson title could launch multi-step automation including searches, downloads, and cleanup operations.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

High
Category
Not specified by scanner
Confidence
95% confidence
Finding

The script introduces credential collection and storage for third-party education platforms even though the file's implemented functionality is primarily local folder and template generation. Collecting unnecessary credentials expands the attack surface and creates a sensitive secret store that could be exposed through workspace access, backups, sync tools, or other local compromise.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The installation guide states that the skill will automatically add activation commands to the user's global memory file at ~/.workbuddy/memory/CLAW.md, which is a persistent configuration change. Making global state changes during installation without explicit informed consent is risky because it affects future agent behavior beyond this skill and can silently widen the trigger surface.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The advertised activation phrases include very broad terms such as '备课', '做课件', '写教案', '教学助手', and 'teaching', which are likely to appear in ordinary conversation. In an agentic system, ambiguous triggers can cause unintended skill activation, routing sensitive user context into this skill without clear user intent.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The natural-language examples present ordinary user requests as activation paths without any clear delimiter or explicit opt-in. This increases the chance that normal educational queries will automatically invoke the skill, which can lead to unintended tool use, file generation, or context exposure.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
89% confidence
Finding

L023-L029 中的“备课”“做课件”“教学助手”“teaching”等命令较为宽泛，尤其“教学助手”与“teaching”缺乏上下文约束，且说明中没有排除条件或限定仅在特定入口内生效。此类高频自然语言词汇更容易与普通交流或其他教学类操作冲突。

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

L031-L037 将“帮我设计一节…”“制作一个…PPT”“创建一个…导学案”描述为自然语言触发，但未说明必须在何种产品上下文、是否需要显式调用该技能、以及哪些相似表述不应触发。这些短语属于常见教学工作表达，缺少边界条件或反例，容易造成非预期激活。

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The skill advertises automatic web searching and downloading of teaching resources without warning users about network transmission, source trust, or the risks of downloaded content. In a system that can fetch external files automatically, this can expose user queries or workspace context to third parties and introduce untrusted files into the local environment.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
87% confidence
Finding

The skill declares an empty allowed-tools scope while its instructions require filesystem access, downloading resources, and cleanup of generated scripts. This mismatch can cause the runtime to grant broader implicit capabilities than users expect, reducing transparency and weakening least-privilege controls.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
86% confidence
Finding

L04 将技能描述为“中小学教师智能备课助手”，整体内容默认采用中文教学语境和中文触发词，但未说明是否支持用户选择其他语言或 locale。按照语言/地区政策，若默认强制单一语言而无用户选择，属于潜在自然语言政策问题。

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
88% confidence
Finding

The skill instructs users to place account data in a local JSON file for multiple education platforms but provides no privacy notice, storage protections, or safe-handling guidance. In a teaching workflow, this is more dangerous because users may assume convenience features are safe and may expose reusable credentials in plaintext workspace storage.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The workflow bundles network search, resource download, account-based access, and cleanup steps but lacks any overall risk disclosure or checkpoints. This is unsafe because users are not clearly informed that activating a lesson-prep skill may cause external requests, local file changes, and deletion behavior.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The module description and all user-facing messages are written only in Chinese, indicating the skill is designed to operate in a single language. The file does not offer any user opt-in, language selection, or documented justification that this is a region-specific tool, which conflicts with the policy against forcing a specific language without user choice.

Content

No source excerpt is available for this finding.

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · generator.py (reported line 83)May include surrounding context.

python
"--theme", "modern"
        ]

        result = subprocess.run(cmd, capture_output=True, text=True)

        if result.returncode != 0:
            raise RuntimeError(f"PPT 生成失败: {result.stderr}")

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The manifest and module docstring state that the skill supports generating teaching plans and task sheets as Word documents, but this function does not generate any .docx output. It serializes the content to a JSON file and returns that JSON path, which materially differs from the advertised behavior of producing complete lesson-preparation documents.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
99% confidence
Finding

The docstring explicitly documents '生成的 Word 文件路径' as the return value, while the implementation writes a JSON file and returns str(data_file). This is a direct contradiction between code documentation and actual behavior, not merely omitted detail.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
83% confidence
Finding

The document presents all examples, prompts, filenames, and operating assumptions exclusively in Chinese, with no indication that users may choose another language or locale. Under the policy, forcing a specific language without user opt-in is a natural-language policy concern unless the locale restriction is explicitly documented and justified.

Content

No source excerpt is available for this finding.

Skill Enumeration

Medium
Category
Agent Snooping
Confidence
80% confidence
Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · integration_demo.md (reported line 150)May include surrounding context.

md
- 思维导图使用指南: `references/mindmap_guide.md`
- 课件制作指南: `references/ppt_guide.md`
- diagram-generator 技能文档: `~/.workbuddy/skills/diagram-generator/SKILL.md`

## 常见问题

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The document explicitly recommends saving content from commercial education platforms via screenshots when downloads are restricted, but it does not warn about copyright, licensing, or terms-of-service constraints. In a skill that helps users gather teaching materials, this can normalize unauthorized copying of restricted content and facilitate policy or IP violations at scale.

Content

No source excerpt is available for this finding.

Ssd 4

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The text presents a stepwise strategy for bypassing platform download restrictions through screenshots, page clipping, and content extraction/repackaging. Even without technical exploitation code, this is operational guidance for circumventing access and reuse controls, which is risky in a content-harvesting teaching assistant that may automate collection and redistribution.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The guide explicitly states that the system will automatically generate files and save them to a fixed local path on disk, but it does not mention obtaining explicit user consent, confirming overwrite behavior, or warning that local files will be created or modified. In an agent skill that may trigger document generation, this can lead to unintended filesystem writes, overwriting existing teaching materials, or confusing users about where artifacts are stored.

Content

No source excerpt is available for this finding.