Personal Tutor

• Outcome: Review
• Latest audit: Sep 16, 2026 · 9:03 AM UTC
• Version: 1.0.3

Overview

This tutoring skill mostly matches its learning-record purpose, but it asks agents to change their own persistent rule files and gives user-provided schema files unsafe instruction priority.

Review before installing. Use only trusted learning and knowledge-base paths, avoid pointing schemaPath at shared or synced files unless you fully trust them, and do not allow this skill to edit global agent rule files such as SOUL.md, TOOLS.md, or broad memory policy files. Ask for a path preview and confirmation before archival writes.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

Findings (2)

T02 · Agent Memory Poisoning

Error

• Location: SKILL.md:325

Finding

Persistent Modification of Agent Policy and Tool Rule Files

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, line 325
Vulnerability Type: Persistent agent memory and behavioral-rule poisoning
Risk Level: High

Vulnerable code snippet:

markdown

- Record this as a lesson learned — update your own rules (SOUL.md, TOOLS.md, etc.) to make it harder to skip next time.

Technical Analysis

The skill explicitly instructs the agent to modify persistent files such as SOUL.md and TOOLS.md after an archive-verification failure. These files may define global agent behavior, identity, operational constraints, or tool-use rules and are not limited to the tutoring workflow.

This violates isolation between skill-specific state and persistent agent policy. A tutoring skill only needs to maintain subject progress, lesson records, and knowledge-base metadata. It does not require authority to rewrite global behavioral or tool configuration. Because the instruction is triggered by a workflow outcome rather than explicit user authorization, it can cause persistent changes without a sufficiently informed approval step.

Although the repository does not contain a predefined malicious replacement payload, the directive creates a mechanism through which contextual or attacker-controlled content could be incorporated into persistent rules. The resulting behavior may continue after the skill invocation ends and affect unrelated sessions.

Attack Path

1. A user or attacker invokes the personal-tutor skill and starts a lesson.
2. The archive process is skipped, interrupted, or represented as having failed.
3. The skill enters its documented failure-recovery procedure.
4. The agent follows line 325 and opens persistent rule files such as SOUL.md or TOOLS.md.
5. Context-derived instructions are added to those files as a supposed “lesson learned.”
6. Future sessions load the modified rules.
7. The injected behavior persists beyond the tutoring session and may influence unr ...[truncated 837 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove all instructions that modify SOUL.md, TOOLS.md, global memory, identity files, or equivalent agent policy resources.
2. Store recovery information only in a namespaced, skill-owned state file, such as .personal-tutor-state.json.
3. Restrict stored recovery data to declarative fields such as the subject identifier, failed archive layer, timestamp, and retry status.
4. Require explicit, informed user confirmation before modifying any persistent configuration outside the skill-owned state directory.
5. Enforce an allowlist of writable paths rooted under the configured learning and knowledge-base directories.
6. Treat agent policy, identity, system prompts, tool definitions, and global memory files as permanently read-only to this skill.
7. If a workflow failure occurs, report it to the user and record it in the subject learning log rather than changing the agent’s rules.
8. Add a host-level control preventing skill text from authorizing modifications to higher-trust instruction files.

T01 · Skill Instruction Hijacking

Error

• Location: SKILL.md:335

Finding

Untrusted Custom Schema Is Granted Instruction Priority

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, line 335
Vulnerability Type: Indirect prompt injection through an untrusted local schema file
Risk Level: High

Vulnerable code snippet:

markdown

> ⚠️ If a custom `schemaPath` is configured, read that file before every concept extraction — its rules take priority over the defaults below.

The same unsafe precedence rule is also documented at SKILL.md:77 and SKILL.md:255.

Technical Analysis

The skill allows a user-configured file at knowledgeBase.schemaPath to supply rules and explicitly grants those rules priority over the skill’s built-in defaults. The file is read as natural-language instructions rather than parsed as a constrained declarative schema.

A file located in a notes directory or shared vault must be treated as untrusted data. It may be modified by another user, synchronized from another system, generated by an external application, or contain malicious prompt-injection text. Granting such content instruction priority allows it to alter the agent’s current objectives when concept extraction runs.

No validation, instruction filtering, path confinement, directive allowlist, or trust-boundary statement limits the schema to formatting fields. Consequently, a malicious schema can attempt to direct the agent to read unrelated files, write outside the intended knowledge-base folder, disclose information, ignore workflow restrictions, or alter persistent state. The agent’s actual permissions remain bounded by the host environment, but the skill text supplies a plausible instruction-hijacking channel.

Attack Path

1. The victim configures knowledgeBase.schemaPath to reference a schema in a shared, synchronized, or attacker-influenced knowledge base.
2. An attacker inserts imperative prompt-injection text into that file while preserving the appearance of formatting rules.
3. The victim completes a lesson with full knowledge-base arch ...[truncated 1397 chars]

Remediation

View remediation

Remediation Suggestions

1. Replace the natural-language schema mechanism with a strict declarative format such as validated JSON or YAML.
2. Allow only documented presentation properties, such as heading names, filename patterns, language preferences, and approved metadata fields.
3. Reject imperative statements, tool-use requests, shell commands, external URLs, and instructions to read or write unrelated files.
4. State explicitly that schema content is untrusted data and cannot override system, developer, user, safety, or skill-level constraints.
5. Canonicalize schemaPath and require it to resolve inside an explicitly approved knowledge-base root.
6. Reject symbolic-link escapes and path traversal outside approved directories.
7. Display the resolved schema path and request confirmation before using a newly configured or changed schema.
8. Parse only recognized fields and ignore all unknown text instead of feeding the complete file into the agent as instructions.
9. Apply a write allowlist that confines generated notes to the configured subject and index locations.
10. Record and verify a schema hash so unexpected modifications can be detected before the file is used.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence

Findings (13)

Hidden Instructions

High

• Category: Prompt Injection
• Confidence: 60% confidence

Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 1)May include surrounding context.

md

---
name: personal-tutor
description: >
  🎓 Personal Tutor — Your private AI learning coach. 你的私人AI学习导师。

Self-Modification

High

• Category: Rogue Agent
• Confidence: 99% confidence

Finding

The instruction to 'update your own rules' after a missed step is a direct self-modification mechanism. In hostile or mixed-trust environments, allowing a skill to rewrite persistent agent rules can let untrusted task content shape future behavior, weaken safeguards, or create durable prompt-injection effects beyond the tutoring session.

Content

Scanner excerpt · SKILL.md (reported line 325)May include surrounding context.

md

**If the user catches you skipping a layer** (they will notice):
- Stop immediately. Do not argue. Do not defend.
- Fix the missing layer right there.
- Record this as a lesson learned — update your own rules (SOUL.md, TOOLS.md, etc.) to make it harder to skip next time.

### Multi-Agent Guarantee / 多智能体保障

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The README emphasizes convenience and automation but does not prominently warn that the skill writes to the user's workspace, updates a config file, and may create or modify knowledge-base files. Users may invoke it without understanding that actions persist beyond chat, which weakens informed consent and makes accidental destructive or privacy-impacting changes more likely.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

"Update learning records" is generic enough to appear in normal study discussions, so the agent may misinterpret conversational text as a command. In this skill, that command triggers multi-layer state and file updates, increasing the risk of unintended edits to logs, config, memory, and knowledge-base content.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The trigger phrase "start learning [any subject]" is very broad and resembles natural conversation, making accidental invocation plausible during ordinary chat. Because this skill creates and updates files, an unintended trigger could cause filesystem writes, config creation, or knowledge-base modifications without deliberate user intent.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 75% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 23)May include surrounding context.

md

- Hardened Post-Lesson Self-Verification Protocol: added 🚨 red-line warning banner, self-check mantra (1️⃣2️⃣3️⃣), and explicit "user-caught-skipping" failure behavior.
  v1.0.2 (2026-05-29):
  - Updated description with bilingual rebranding announcement (knowledge-digest → personal-tutor).
  - Scenario 2: Added mandatory Post-Lesson Self-Verification Protocol; agent cannot declare "lesson complete" without checking all archive layers.
  - New section: Post-Lesson Self-Verification Protocol — a universal checklist for multi-agent scenarios.
  - Common Edge Cases: Added "Skipped Archiving" failure mode with recovery procedure.
  v1.0.0 (2026-05-28): Initial release.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill directs the agent to create directories, generate files, and update configuration in the user's filesystem as part of normal operation, but it does not require a clear user-facing consent step immediately before those writes. In an agent environment, silent persistent file creation increases the risk of unintended modifications, misuse of broad filesystem permissions, and user surprise.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The skill instructs the agent to update memory with subject progress without first warning the user that conversation-derived information may be stored persistently outside the current session. This creates a privacy and consent risk because learning history, weaknesses, and progress data may be retained unexpectedly.

Content

No source excerpt is available for this finding.

Ssd 3

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The skill requires persistent retention of user learning-session details across multiple storage layers including logs, memory, and a knowledge base. Even if intended for helpful continuity, this broad and durable collection of behavioral and educational data increases privacy exposure and the blast radius of any compromise of those stores.

Content

No source excerpt is available for this finding.

Ssd 3

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The skill explicitly says it turns conversations into permanent knowledge and archives user interaction details in long-term storage. That behavior is privacy-sensitive because freeform chat may contain personal data, mistaken disclosures, or contextual information the user did not intend to preserve indefinitely.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The skill explicitly instructs the agent to modify its own persistent rule files such as SOUL.md and TOOLS.md after a user-visible failure. That exceeds the stated tutoring purpose and creates a self-modification pathway where untrusted skill content can alter future agent behavior beyond the current task, potentially persisting unsafe policies or prompt-injected instructions.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low

• Category: Not specified by scanner
• Confidence: 79% confidence

Finding

Early description text says the three archive layers are learning records, memory, and knowledge base, but later Scenario 3 defines post-lesson archive as updating six layers including syllabus, index, and config. The self-verification output in Scenario 2 then reports learning records, knowledge base, and config, omitting memory, which contradicts the protocol's stated three mandatory layers.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low

• Category: Not specified by scanner
• Confidence: 81% confidence

Finding

The design principle says 'Never overwrite existing knowledge base content; always check for duplicates first,' implying non-destructive behavior. Elsewhere, the workflow explicitly updates existing files, adds backlinks, refreshes indexes/outlines, and renames old logs when restarting a subject, which are side effects beyond the stated non-destructive characterization.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.