Security audit
Security checks for vulnerabilities and agentic risk
The skill is a coherent Chinese college-admissions advisor, but it asks for broad shell execution and shows unsafe command patterns using student-supplied text.
Review this skill carefully before installing. It should not be used unless the package includes the referenced scripts and data, and the shell workflow is changed to avoid placing student-supplied values into command strings. Expect student profile details, assessment answers, snapshots, and reports to be stored locally if the workflow is used.
SKILL.md:8Shell Command Injection Through User-Controlled Profile Values
描述中的触发条件不仅包含明确的高考相关短语，还列出了“分数”“位次”“选学校”等较泛化表达。这些词在更广泛的教育或日常咨询语境中也常见，且未提供负例或排除条件来限定何时不应触发该技能。
The skill grants execute_bash and explicitly instructs the agent to run local Python scripts for routine admissions counseling. That creates an unnecessarily broad code-execution capability for a low-risk advisory use case, and if the surrounding files or user-influenced arguments are tampered with, the agent could execute unintended commands or access local workspace data.
The skill describes save/restore/export behavior and local CLI execution without clearly disclosing that user data will be written into workspace files. This can expose sensitive student profile data to unexpected persistence, increase privacy risk, and make users unaware that their inputs may remain on disk and be recoverable later.
文件整体以中文定义触发条件和交互内容，且面向高考志愿咨询，但没有明确说明这是仅适用于中文/中国高考场景的区域化技能，也没有为其他语言用户提供选择。根据组织语言/locale 政策，强制单一语言而无用户选择可能构成自然语言策略问题。
Lines L024-L026 claim recommendations must strictly align with facts.json and data/ knowledge. But later sections define a workflow that reads and writes per-user facts, snapshots, and reports under workspace/sessions/{uid}, so actual operation depends on mutable session files in addition to the stated fixed sources. This is a documentation-to-behavior mismatch within the file's own instructions.
The manifest presents the skill as a college-application and major-selection advisor, but the file documents additional operational behavior: initializing per-user sessions, saving/restoring snapshots, listing other student folders, and exporting reports to disk. These stateful file-management capabilities go beyond the plain advisory description and are not disclosed in the manifest text.
No suspicious patterns detected.