Security audit

Flashcard

Security checks for vulnerabilities and agentic risk

Overview

This skill is not obviously malicious, but it needs review because it advertises deck-managed flashcards while shipping broader study-helper scripts that also store local notes and history.

Review the skill before installing if you expect a real flashcard deck manager. It appears locally contained and does not fetch code or access credentials, but its advertised commands do not match the implementation and one script stores notes/history in a local flashcard data directory.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration

Findings (8)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 91% confidence
Finding: The declared description promises a spaced repetition study tool with deck management for flashcards. The code is instead a lightweight shell CLI that echoes template text for commands like learn, quiz, roadmap, resource, summary, and test, and logs usage locally. While there is a review command that references spaced repetition intervals, there is no implementation of scheduling, card state, decks, or flashcard storage/management. The flashcard command only prints a placeholder message and logs the action; it does not create or manage a deck. The note command appends text to a local log file, and progress merely counts lines in that file. So the primary theme is educational assistance, but the specific declared functionality is materially overstated and inaccurate.

Description-Behavior Mismatch

Medium

Confidence: 96% confidence
Finding: The implemented command set materially exceeds the declared flashcard/deck purpose and exposes broader study-assistant capabilities than users or platform reviewers would expect. This scope mismatch is dangerous because it weakens trust boundaries, can bypass approval assumptions for a narrowly scoped skill, and increases the attack surface for future unsafe behavior in unrelated commands.

Context-Inappropriate Capability

Medium

Confidence: 94% confidence
Finding: The note-taking, roadmap, resource, summary, and testing features are generic assistant functions not justified by a flashcard tool and represent unnecessary privilege/scope expansion. In this context, that makes the skill more dangerous because users may supply broader personal or study data to a tool they believe is only managing flashcards, and reviewers may underestimate what the skill actually does.

Vague Triggers

Low

Confidence: 94% confidence
Finding: The description says "Use when you need flashcard," which is vague and does not define specific trigger phrases or constraints. This broad wording could cause unintended invocation for general studying or note-taking requests rather than explicit flashcard actions.

Natural-Language Policy Violations

Low

Confidence: 90% confidence
Finding: The script's help section presents command descriptions and usage examples in Chinese, while the rest of the file is primarily in English. This creates an implicit language/locale constraint without user opt-in or explanation, which fits the policy category for forced language behavior.

Intent-Code Divergence

Low

Confidence: 87% confidence
Finding: The script self-describes as a general 'Learning and study assistant,' which contradicts the narrower flashcard/deck metadata and reinforces the scope-mismatch issue. While not directly exploitable on its own, misleading internal documentation contributes to deceptive packaging and increases the likelihood that unsafe or unreviewed capabilities are hidden behind an innocuous label.

Missing User Warnings

Low

Confidence: 89% confidence
Finding: User-provided note content is persisted to a local file without an explicit warning or consent signal, which can expose sensitive study notes or personal information to other local processes or users depending on system configuration. In a study-assistant context, users may reasonably enter private notes, making silent storage more privacy-sensitive than the minimal functionality suggests.

Natural-Language Policy Violations

Low

Confidence: 91% confidence
Finding: The instructional content is entirely written in Chinese, which constitutes a language-specific constraint in the skill's natural-language interface. There is no indication that the user can opt into another language or that the locale restriction is justified as region-specific.

Static analysis

No suspicious patterns detected.