T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/student_manager.py:18- Finding
Arbitrary JSON File Read and Write Through Unsanitized Student Identifier
- Content
View full analysis
- Remediation
View remediation
Security audit
AI Tutor
Security checks for vulnerabilities and agentic risk
Overview
The tutoring skill is coherent, but it persistently profiles students and has an unsafe profile-file path design that users should review before installing.
Install only if you are comfortable with local student profiles being created and retained. Before use with children or real student data, require explicit consent, define retention and deletion rules, restrict file permissions, validate student IDs, and avoid entering sensitive personal information.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)
Vulnerability Patterns
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (8)
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 70% confidence
- Finding
Without declared permissions the skill's intent is opaque and cannot be validated.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The trigger conditions are extremely broad and overlap with routine educational requests, which can cause the skill to activate in more contexts than users expect. In an education setting this increases the chance of unintended handling of student conversations and related data, especially when the skill also claims to retain learning history.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The skill states that it records student learning history and forms a knowledge graph, but gives no user-facing notice about retention, access, deletion, or consent. Because the audience includes minors, undisclosed persistence of educational data is particularly sensitive and raises privacy and compliance concerns.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
Recording learning trajectories, weak points, and review reminders implies ongoing profiling and persistent storage, yet the skill does not warn users or explain data handling practices. In a tutoring product for children and teenagers, this creates elevated privacy risk because sensitive performance data may accumulate over time without informed consent.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The prompt states the tutor is specifically for Chinese students, and the entire skill is written to operate in Chinese without any opt-in or alternative language handling. The policy explicitly flags language or locale constraints when they are forced rather than offered as a user choice or clearly justified as a region-specific compliance requirement.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The top-level natural-language description is entirely in Chinese and presents the skill as a Chinese-language tutoring/profile system without any opt-in or alternative locale. Under the policy, forcing a specific language without user choice is a language/locale policy violation.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The code persistently stores student learning profiles to a local directory without any notice, consent flow, retention policy, or access controls. In the context of a tutoring skill for minors, this creates a real privacy risk because educational history, weak points, and grade data are written to disk and can accumulate silently.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 83% confidence
- Finding
The description states that the system is '专为中国学生设计', indicating a locale-specific focus. The file does not mention that other users can choose a different locale, curriculum, or language, so it may constitute an unnecessary locale constraint.
- Content
Static analysis
No suspicious patterns detected.