Security audit

成都大学新生一站式指南

Security checks for vulnerabilities and agentic risk

Overview

This is a coherent Chengdu University freshman guide, but it needs Review because it ships sensitive default-password guidance and maintenance scripts that can expose names from chat data.

Before installing, understand that the normal skill is a campus Q&A guide and I did not find automatic execution, credential theft, exfiltration, or destructive actions. Review is warranted because the package republishes predictable default-password patterns and includes maintenance scripts that can expose names if used with raw chat exports. Treat the KB as unofficial, verify important school/account information through official channels, and do not run the maintenance scripts on private chat data unless you first remove the name-list logging/reporting behavior.

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (9)

Vague Triggers

Medium

Confidence: 88% confidence
Finding: The trigger list is extremely broad and includes common campus and everyday education terms, which can cause the skill to activate outside a clearly scoped Chengdu University intent. That increases the chance the skill hijacks unrelated conversations and applies its fixed routing/instruction set in contexts where it should not, creating prompt-scope confusion and potential misuse of search/tool behavior.

Natural-Language Policy Violations

Medium

Confidence: 80% confidence
Finding: The skill mandates a specific persona and response style ('熊猫口吻') regardless of user preference, which can override user-requested language, tone, or accessibility needs. While not a direct exploit primitive, this is a policy/control weakness because it reduces user agency and can cause unsafe mismatches in contexts requiring neutral, concise, or differently localized responses.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The script prints both the inferred real-name list and the excluded candidate-name list to stdout during processing. In a desensitization workflow, console logs are often captured by shells, CI systems, terminal history tools, or remote job runners, so this behavior can leak precisely the personal data the tool is supposed to protect.

Missing User Warnings

High

Confidence: 99% confidence
Finding: The generated report persists the full '真实姓名清单' and '排除名单' to desensitize_report.json, creating a new structured file of extracted personal identifiers. This undermines the purpose of the desensitization tool because anyone with access to the output directory or backups can recover sensitive names, including names that were only inferred during analysis.

Missing User Warnings

Medium

Confidence: 88% confidence
Finding: The script outputs matched chat message excerpts from a dataset of desensitized group conversations directly to stdout. Even if the source is labeled desensitized, printed excerpts can still reveal sensitive contextual information, facilitate re-identification, or expose private discussions when logs, terminals, or downstream tooling capture the output. The skill context makes this more credible because the script is explicitly mining 'high-value facts' from chat archives rather than operating on fully synthetic data.

Ssd 3

Medium

Confidence: 96% confidence
Finding: This entry publishes a default authentication secret pattern for campus card account setup ('initial password' derived from part of an ID number). Even if intended for legitimate onboarding, exposing predictable default credentials lowers the barrier for unauthorized access attempts against student accounts, especially when usernames or identities are easy to guess.

Ssd 3

Medium

Confidence: 97% confidence
Finding: This item discloses a learning platform's default password construction rule based on a student's identifier suffix. Predictable credential formulas are dangerous because account identifiers are often broadly known within a campus context, enabling credential stuffing or opportunistic account takeover attempts.

Ssd 3

Medium

Confidence: 97% confidence
Finding: The official channels section republishes the campus card authentication default password rule, amplifying exposure by placing sensitive credential guidance in a centralized, easily redistributed resource. The context makes this more dangerous because the file is designed to generate downstream JSON artifacts for broad consumption, increasing the audience and persistence of the secret pattern.

Ssd 3

Medium

Confidence: 98% confidence
Finding: This official channel entry republishes a default password formula for the learning platform, making authentication details available to any consumer of the generated KB. In this knowledge-base distribution context, such information is more risky than in a restricted internal SOP because it facilitates unauthorized access attempts at scale.

Static analysis

No suspicious patterns detected.