ClawHub
Back to skill

Security audit

Japanese Tutor

Security checks for vulnerabilities and agentic risk

Overview

This Japanese tutor skill is mostly coherent, but it sends PDFs to Google Gemini and saves extracted study content into local reference files without clear user consent controls.

Review this skill before installing if you may use it with private schoolwork, IDs, grades, copyrighted course packets, or sensitive documents. Only use the PDF parser when you are comfortable sending the file to Google Gemini, and prefer requiring the agent to ask before saving extracted content into reference files.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Findings (15)

Tp4

High
Category
MCP Tool Poisoning
Confidence
99% confidence
Finding

The declared description presents a broad interactive Japanese learning assistant with multiple study and document-processing capabilities. The supplied code chunk does not implement any of those core features. Instead, it simply selects a greeting based on the current time and outputs it. While Japanese greetings are loosely related to the language domain, the code’s primary behavior is materially narrower and different from the declared purpose, so this is a clear description-behavior mismatch.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High
Category
Not specified by scanner
Confidence
98% confidence
Finding

The code does not parse the PDF locally; it uploads the entire user-provided PDF to Gemini using upload_file and then requests transcription. This can expose homework, personal data, or copyrighted materials to a third party in a way that is inconsistent with user expectations for a tutoring assistant.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
70% confidence
Finding

Without declared permissions the skill's intent is opaque and cannot be validated.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The skill explicitly instructs the agent to append user-derived material into local reference files without warning or consent, creating unauthorized persistent modification of the local workspace. This is dangerous because uploaded study materials or homework may contain sensitive, copyrighted, or prompt-injected content that then becomes durable state and may influence future interactions.

Content

No source excerpt is available for this finding.

Ssd 3

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

Persisting concepts extracted from uploaded study materials into shared reference files creates a data-retention path for user content beyond the immediate task. In a tutoring skill, this is especially risky because educational documents often include personally authored work, school materials, names, IDs, or proprietary content, and saved excerpts can later be exposed to other users or sessions.

Content

No source excerpt is available for this finding.

Ssd 3

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The homework workflow repeats the same persistence pattern for user-submitted files, creating durable semantic storage of uploaded content and concepts. Because homework files can contain personal data, class identifiers, and original student work, retention increases privacy exposure and can also let adversarial content poison future reference files used by the skill.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
88% confidence
Finding

The quick-action trigger phrase is broad enough to match ordinary conversation, which can cause the skill to activate unexpectedly and perform file parsing or other side effects without clear user intent. In this skill, accidental activation is more concerning because the instructions also include persistence of extracted content into reference files, turning a conversational collision into unintended data processing and retention.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The script explicitly retrieves a Gemini API key from the environment to send user-supplied document content to Google's cloud service. In a tutoring/parsing skill, this expands the trust boundary and creates a data disclosure risk, especially if users expect local document handling based on the skill description.

Content

No source excerpt is available for this finding.

Cloud Storage Exfiltration

Medium
Category
Data Exfiltration
Confidence
90% confidence
Finding

The upload_file call is a direct file exfiltration primitive: any PDF path supplied to the script is sent off-host to cloud storage/model infrastructure. In this skill's context, that is dangerous because the feature is framed as homework help and document parsing, so users may provide sensitive educational or personal files without realizing they leave the local environment.

Content

Scanner excerpt · scripts/parse_pdf_gemini.py (reported line 14)May include surrounding context.

python
try:
        # Upload the file
        sample_file = genai.upload_file(path=pdf_path, display_name="Japanese Homework")
        
        # Use a model that supports multimodal input
        model = genai.GenerativeModel(model_name="gemini-2.0-flash")

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The PDF is transmitted to an external API without any user-facing warning, confirmation step, or privacy notice in the code path. Because study materials may contain identifying information, grades, or school records, silent third-party transmission is a meaningful privacy and compliance risk.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
76% confidence
Finding

The guidance includes "Jaksel/Relaxed style if requested," which introduces a locale-specific communication style. While partially conditional, the skill does not clearly establish user language/locale preference handling more broadly, and the presence of fixed example triggers in Indonesian suggests an implicit locale bias.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
87% confidence
Finding

The heading explicitly defines the skill content as 'Japanese Grammar - Beginner Level,' and the document consistently presents instruction only for Japanese. Under the stated policy, forcing a specific language without user opt-in can be a natural-language policy violation unless the locale constraint is clearly documented and justified.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
87% confidence
Finding

This markdown file contains user-facing instructional content exclusively in Indonesian, and there is no indication that the user can opt into another language or that the lesson is intentionally region-specific. Under the stated policy, forcing a specific language without user opt-in can be a natural-language policy violation.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
88% confidence
Finding

This markdown file presents a single language/locale experience focused entirely on Japanese vocabulary, and it does not indicate that the language choice is optional or user-selected. Under the stated policy, forcing a specific language without opt-in can be a natural-language policy violation.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
95% confidence
Finding

The skill returns Japanese greetings by default in all time ranges, which imposes a specific language choice on users without offering any language or locale selection. This is a natural-language policy concern because the file forces a locale/language experience rather than making it optional or user-configurable.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.