教育培训机构专家

• Outcome: Review
• Latest audit: Sep 23, 2026 · 8:18 AM UTC
• Version: 1.0.10

Overview

The skill appears to run local education-accounting checks, but it quietly creates a hidden usage counter and subscription gate despite no-count/no-promotion claims.

Install only if you are comfortable with a Chinese-language local CLI that writes a hidden usage-count file in your home directory and may stop after five runs to request a subscription. I found no evidence that it sends table contents over the network, but the persistence and trial-limit behavior should be disclosed more clearly before routine use on sensitive education or finance records.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (20)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence
• Finding: The declared 'composite expert skill' behavior appears inconsistent with an implementation that only supports a single sub-skill or lacks the promised automatic triage. That mismatch is security-relevant because it can cause integrity failures in decision support: users may submit sensitive financial tables expecting comprehensive analysis, while the tool silently performs less coverage than promised.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 93% confidence
• Finding: The declared 'composite expert skill' behavior appears inconsistent with an implementation that only supports a single sub-skill or lacks the promised automatic triage. That mismatch is security-relevant because it can cause integrity failures in decision support: users may submit sensitive financial tables expecting comprehensive analysis, while the tool silently performs less coverage than promised.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence
• Finding: The declared 'composite expert skill' behavior appears inconsistent with an implementation that only supports a single sub-skill or lacks the promised automatic triage. That mismatch is security-relevant because it can cause integrity failures in decision support: users may submit sensitive financial tables expecting comprehensive analysis, while the tool silently performs less coverage than promised.

Ae1

High

• Category: analysis-evasion

Content

node scripts/run.mjs --list # 看覆盖了哪些子问题

• Confidence: 100% confidence
• Finding: Referenced artifact was not completely inspected

Ae1

High

• Category: analysis-evasion

Content

node scripts/run.mjs --list # 看覆盖了哪些子问题

• Confidence: 100% confidence
• Finding: Referenced artifact was not completely inspected

Ae1

High

• Category: analysis-evasion

Content

node scripts/run.mjs --list # 看覆盖了哪些子问题

• Confidence: 100% confidence
• Finding: Referenced artifact was not completely inspected

Ae1

High

• Category: analysis-evasion

Content

node scripts/run.mjs --list # 看覆盖了哪些子问题

• Confidence: 100% confidence
• Finding: Referenced artifact was not completely inspected

Ae1

High

• Category: analysis-evasion

Content

node scripts/run.mjs --list # 看覆盖了哪些子问题

• Confidence: 100% confidence
• Finding: Referenced artifact was not completely inspected

Vague Triggers

Medium

• Confidence: 95% confidence
• Finding: The keyword list includes very generic triggers such as “免费”, “对账”, and “核对”, which are common in ordinary business conversations and unrelated workflows. This can cause the agent to route unintended user inputs into this skill, leading to incorrect handling of uploaded tables or misleading financial reconciliation outputs in a sensitive education-finance context.

Vague Triggers

Medium

• Confidence: 91% confidence
• Finding: This trigger set again contains broad terms like “免费” and phrases that may appear in many education or finance chats, increasing the chance of accidental invocation. In this skill, accidental activation is more dangerous because the tool appears to make line-by-line accounting conclusions, so misrouting can produce authoritative but inapplicable results.

Vague Triggers

Medium

• Confidence: 96% confidence
• Finding: The keyword array includes highly generic terms such as “免费”, “对账”, and “核对”, which are too common to safely use as sole routing signals. Because this subskill deals with prepaid tuition and revenue recognition, an incorrect match could lead users to trust wrong reconciliation logic on unrelated financial data.

Vague Triggers

Medium

• Confidence: 94% confidence
• Finding: The presence of generic triggers such as “对账” and “核算核对” makes this refund-related skill easy to match during routine accounting discussions. In a tuition/refund workflow, false activation can expose users to incorrect refund calculations or misplaced confidence in outputs derived from the wrong dataset.

Natural-Language Policy Violations

Medium

• Confidence: 87% confidence
• Finding: The file’s natural-language interface and guidance are written entirely in Chinese, including the top-level description and stated contract, with no indication that the skill is limited to Chinese-speaking users or that language selection is available. This can violate language/locale policy expectations when a skill is used in broader contexts without explicit user opt-in.

Natural-Language Policy Violations

Medium

• Confidence: 95% confidence
• Finding: The file’s user-facing natural-language contract, guidance, and output strings are all in Chinese, including required input advice and result messages. For a general-purpose skill, forcing a single language without user opt-in can violate language/locale policy unless the locale restriction is explicitly justified.

Intent-Code Divergence

Medium

• Confidence: 98% confidence
• Finding: The header text claims the public version does not write any statistics files, yet the code persists a usage counter under the user's home directory. This is dangerous because it creates undisclosed local state and tracking behavior contrary to the privacy and locality assurances given to users, which is especially sensitive for a tool handling educational and financial records.

Intent-Code Divergence

Medium

• Confidence: 97% confidence
• Finding: The help and listing output state that all sub-skills are complete and bundled locally, but the runtime explicitly supports missing local engines and subscription-only functionality. This mismatch is a deceptive interface issue that can cause users to rely on unavailable local processing guarantees and make decisions based on false assumptions about package completeness.

Description-Behavior Mismatch

Medium

• Confidence: 95% confidence
• Finding: The runner advertises coverage of all 4 sub-skills, but at runtime it can refuse to execute a selected sub-skill if its engine is not bundled locally and instead directs the user to a subscription version. This is a deceptive capability mismatch that can mislead users into providing data under false expectations and undermine trust in what functionality is actually present.

Natural-Language Policy Violations

Low

• Confidence: 84% confidence
• Finding: The `display_name_en` field is populated with Chinese text rather than an English label. This creates a locale/language policy issue because the skill metadata does not provide a real English-language variant or indicate that Chinese-only presentation is intentional and limited to a specific audience.

Description-Behavior Mismatch

Low

• Confidence: 80% confidence
• Finding: The skill description centers on auditing uploaded tables and, when materials are insufficient, truthfully reporting missing columns instead of giving conclusions. This file adds unrelated trial-counting and subscription gating that can stop execution before any material sufficiency check, which is outside the described analysis behavior.

Natural-Language Policy Violations

Low

• Confidence: 87% confidence
• Finding: The JSON contains only Chinese-language text for headers and sample data, with no indication that language selection is optional or that the content is intended for a China-specific context. Under the policy, forcing a specific language without documented opt-in or justification can be a natural-language policy violation.

Static analysis

No suspicious patterns detected.