zhz-english-learning

• Outcome: Pass
• Latest audit: Oct 19, 2026 · 2:21 AM UTC
• Version: 1.0.0

Overview

This skill is a disclosed Chinese-language English-learning helper that reads user-provided lesson files, generates audio through Edge-TTS, and writes local study/quiz pages.

Install only if you are comfortable with online Edge-TTS processing. Do not use sensitive, proprietary, or private lesson text for audio generation unless you accept sending that text to the TTS provider, and generate pages from trusted lesson/question data.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (13)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 94% confidence

Finding

The declared description promises a broader English practice assistant with vocabulary extraction, audio generation, and multiple interactive exercise types. The supplied code chunk is much narrower: it reads text files, optionally reads a translation file, optionally base64-embeds an existing audio file, and writes a lesson HTML page containing the text, translation, audio player, and playback-speed buttons. There is no vocabulary extraction, no TTS/audio generation, and no quiz or comprehension-page generation in this code. While the lesson-study page aligns with part of the description ('课文学习'), the overall declared purpose materially overstates what this code chunk actually does.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence

Finding

The declared description presents a multi-function English learning assistant with vocabulary extraction, audio generation, and interactive study/quiz page creation. The supplied code only performs one subset of that description: text-to-speech conversion of lesson text into an MP3 file. It reads text from an argument, file, or stdin, then uses edge-tts to save audio. There is no logic for extracting words, building learning materials, generating exercises, or creating interactive pages. This is therefore a material description-behavior mismatch due to the much narrower actual functionality.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence

Finding

The declared description presents a broader English-learning assistant with multiple capabilities: extracting vocabulary from lesson text, generating audio, and building interactive study pages with several exercise types. The supplied code chunk is much narrower. It reads a preformatted markdown vocabulary file, generates TTS audio for each entry, and concatenates the results. While audio generation is consistent with part of the description, the major advertised capabilities—text-to-word extraction and interactive page/quiz creation—are absent from this code. Therefore the description does not accurately represent what this specific code chunk actually does.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 70% confidence

Finding

Without declared permissions the skill's intent is opaque and cannot be validated.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The skill explicitly states that audio generation requires network access via Edge-TTS, but it does not warn that user-provided lesson text and vocabulary may be transmitted to an external service. This creates a real privacy and data-handling risk, especially if users supply copyrighted, proprietary, or sensitive educational content under the assumption that processing is local.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

This code file includes user-facing descriptions and UI text entirely in Chinese, starting with the module docstring and continuing throughout the generated quiz page. Under the language/locale policy rule, forcing a specific language without user opt-in is a natural-language policy violation unless the locale restriction is clearly documented and justified.

Content

No source excerpt is available for this finding.

Tainted flow: 'html' from pathlib.Path.read_text (line 289, file read) → pathlib.Path.write_text (file write)

Medium

• Category: Data Flow
• Confidence: 65% confidence

Finding

Data from a source is assigned to a variable that is later passed to a sink, creating a variable-mediated taint flow.

Content

Scanner excerpt · scripts/generate_reading_quiz.py (reported line 293)May include surrounding context.

python

output_path = Path(args.output)
    output_path.parent.mkdir(parents=True, exist_ok=True)
    output_path.write_text(html, encoding="utf-8")
    print(f"[OK] 原文理解测验页已保存：{output_path}（{output_path.stat().st_size / 1024:.1f} KB）")

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

This code file contains natural-language descriptions and user-facing strings that assume Chinese as the only language, starting with the module docstring and continuing throughout the generated UI. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation.

Content

No source excerpt is available for this finding.

Tainted flow: 'html' from pathlib.Path.read_text (line 462, file read) → pathlib.Path.write_text (file write)

Medium

• Category: Data Flow
• Confidence: 65% confidence

Finding

Data from a source is assigned to a variable that is later passed to a sink, creating a variable-mediated taint flow.

Content

Scanner excerpt · scripts/generate_sentence_quiz.py (reported line 466)May include surrounding context.

python

output_path = Path(args.output)
    output_path.parent.mkdir(parents=True, exist_ok=True)
    output_path.write_text(html, encoding="utf-8")
    print(f"[OK] 句子测验页已保存：{output_path}（{output_path.stat().st_size / 1024:.1f} KB）")

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The script sends user-provided text to the external edge-tts service to synthesize audio, but it does not explicitly warn the user that the content will leave the local environment. If the text contains sensitive educational materials, personal data, or proprietary content, this can cause unintended data disclosure to a third-party service.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The module docstring and all user-facing strings are written exclusively in Chinese, indicating the generated quiz UI and CLI messages are fixed to a specific language. The policy requires avoiding forced language or locale constraints unless the skill offers opt-in choice or clearly documents a justified regional limitation, which is not present here.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

Natural-language strings in the module docstring and CLI output are presented only in Chinese, and the script does not provide any user opt-in or locale selection. Under the stated policy, forcing a specific language without user choice is a natural-language policy concern.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The generated page sets lang="zh-CN", which forces a specific language/locale in the output. The file does not provide a user opt-in mechanism or indicate that the skill is intentionally region- or locale-specific, so this matches the policy concern for language forcing.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.