Tp2
High
- Category
- MCP Tool Poisoning
- Confidence
- 85% confidence
- Finding
Mixing characters from multiple Unicode scripts in a single identifier is a common technique to create visually ambiguous tool names.
- Content
Security audit
cs-learning-assistant
Security checks for vulnerabilities and agentic risk
Overview
This is a tutoring skill, but it automatically creates and maintains persistent learner profile and study-history files with broad activation triggers, so users should review it before installing.
Install only if you want a Chinese-default learning assistant that keeps local profile and study-history Markdown files. Before using it, decide whether you are comfortable storing goals, experience level, weak points, mistakes, progress, tags, and review schedules in the workspace, and consider asking for an explicit no-profile or delete/export workflow.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Vulnerability Patterns
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (36)
Natural-Language Policy Violations
High
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
The file is entirely written in Chinese and defines output behavior without indicating that the response language should follow the user’s preference. This can force responses into a fixed language mode, causing user confusion, degraded usability, and possible mishandling of downstream workflows that assume language consistency with the original request.
- Content
Description-Behavior Mismatch
High
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The file defines a persistent user-profile management subsystem with lifecycle rules, trigger conditions, and file-based retention that goes beyond the manifest’s core educational functions like explanation, review, and code analysis. Expanding a learning skill into ongoing profile administration increases the chance of collecting and modifying personal or behavioral data without clear necessity, consent boundaries, or minimization.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
Broad triggers such as generic study, code analysis, and explanation phrases make the skill likely to activate on many ordinary requests, including ones better handled by safer default behavior. Over-broad invocation increases the chance that the skill's persistent profiling and file-writing behavior is engaged without the user's informed intent.
- Content
Shadow Command Trigger
Medium
- Category
- Trigger Abuse
- Confidence
- 70% confidence
- Finding
Shadow Command Trigger: 'explain concept' conflicts with built-in command 'explain'
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The skill directs automatic creation and updating of workspace files, including profile and index artifacts, without upfront user-facing disclosure or consent. Hidden persistence undermines user expectations and can lead to silent retention of personal learning history and metadata.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The skill presents itself as an on-demand learning assistant, but its workflow mandates persistent state creation, longitudinal tracking, and automatic file updates across sessions. This expands data collection and retention beyond what users would reasonably expect, increasing privacy risk and creating unnecessary durable records that could later be exposed or misused.
- Content
Ssd 3
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The skill explicitly retains user profile information across sessions in natural-language files, which may include preferences, goals, and other personal learning data. Persistent storage of personal data without clear minimization, consent, or retention controls creates privacy and secondary-use risks.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
Automatic user profiling, passive accumulation, and snapshot rebuilding are not necessary to answer technical learning questions and create a behavioral record without explicit need. This creates avoidable privacy exposure and can enable over-collection of learner preferences, weaknesses, and history across sessions.
- Content
Ssd 3
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
Passive logging of growth events and snapshotting of learning history creates a cumulative behavioral record of the user's activity, weaknesses, and progress over time. Such longitudinal records increase privacy exposure and can reveal sensitive patterns even if each individual entry seems harmless.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The module says it triggers whenever the user asks to “explain,” “analyze,” or “discuss in depth” a concept, which is broad enough to match many ordinary requests outside the intended skill boundary. Overly broad activation can cause the wrong skill to take control, leading to prompt hijacking of routing, reduced user choice, and unintended disclosure or transformation of content under this skill’s behavior.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
整个技能说明及固定话术均以中文编写，且未说明可根据用户偏好切换语言，存在默认强制特定语言/locale 的倾向。根据规则，若未提供语言选择、用户 opt-in，可能构成自然语言层面的语言政策违规。
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
该 markdown 文件定义了技能触发条件，其中“帮我深度理解”属于较宽泛的自然表达，可能出现在许多普通教学或解释场景中，而不仅限于此互动模式模块。文件也未提供明确的边界、排除条件或负例，难以判断何时应激活该技能、何时不应激活。
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
“帮我理解”“为什么是这样”都是高频通用表达，可能在大量普通问答中出现，不足以唯一指向苏格拉底式互动模式。该处没有说明是否需要显式进入模式、上下文前提或不触发的情况，因此存在意外调用风险。
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The entire skill content is written in Chinese and the templates embed Chinese labels and commands, including the resume command example. There is no indication that the user can choose another language or that the Chinese-only format is a justified locale restriction.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The phrase “当需要创建特定类型的文件时触发” is a very broad activation condition for a markdown skill. It does not define specific trigger phrases, scope boundaries, or exclusion cases, so it could overlap with many ordinary requests involving file creation.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The skill imposes a default requirement to always add Chinese comments for complex logic without checking user preference or project conventions. This can cause unwanted code modifications, reduce usability for non-Chinese-speaking users or teams, and create compliance/process issues in multilingual codebases, though it is not a direct code-execution security flaw.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The module states it should trigger whenever the current topic belongs to one of several categories, but it does not define clear activation boundaries or precedence rules. In an agent skill system, overly broad activation can cause unintended invocation, context hijacking, or inappropriate application of domain-specific instructions to unrelated user requests.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The CS triggers include very common technical terms like algorithms, data structures, operating systems, and architecture, which are likely to appear in ordinary conversation. This can cause the skill to activate too broadly, increasing the chance of misrouting requests or applying the wrong guidance path.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The network/security section uses broad category terms such as HTTP, web security, and cryptography without specifying what kind of user request should activate the module. Because these are common terms in technical discussions, the skill may over-trigger and steer benign or unrelated conversations into security-focused behavior.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
AI/ML trigger phrases like neural networks, deep learning, and ML algorithms are very broad labels that cover a large portion of normal technical discussion. Without scope limits, the module may activate in situations where the user is not seeking teaching behavior, reducing predictability and increasing the risk of unintended instruction routing.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
The software engineering trigger list includes highly generic terms like architecture, system design, and DevOps, which commonly occur in routine engineering conversations. This creates ambiguous activation behavior that can cause the skill to engage when another tool or skill would be more appropriate.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The code-detail triggers rely on generic concepts like programming syntax, libraries, and tools, which are too broad to safely distinguish intended activation. In practice, this can make the module fire on nearly any coding discussion, creating excessive privilege in routing and reducing control over when specialized instructions apply.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The trigger terms “调研”、“调查” and “检查最新信息” are broad, common phrases that can overlap with ordinary user requests, causing the skill to activate outside its intended scope. In a skill that changes retrieval strategy and source selection, this can lead to unintended behavior, user confusion, or unnecessary access to external research pathways, though it is not directly a code-execution issue.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
Defaulting to Chinese-language sources without first checking the user’s language preference can bias results, reduce source quality for some topics, and suppress access to more authoritative or current material available primarily in English. In a research strategy module, this is especially risky because it systematically shapes evidence selection and may lead to incomplete or skewed technical guidance.
- Content