Security audit

Word Memory

Security checks for vulnerabilities and agentic risk

Overview

This is a straightforward Chinese vocabulary-learning skill with local progress storage and no evidence of hidden, destructive, or exfiltrating behavior.

Install only if you are comfortable with a Chinese-language vocabulary helper storing local study progress and preferences. The documented network dictionary lookup and daily reminder features are not implemented in the inspected code, so review future updates if those capabilities are added.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (6)

Natural-Language Policy Violations

Medium

Confidence: 93% confidence
Finding: The README presents all usage instructions, examples, and descriptions in Chinese, which effectively forces a specific language for users. Under the policy, language constraints should either provide user choice or be explicitly documented and justified as region-specific.

Lp3

Medium

Category: MCP Least Privilege
Confidence: 92% confidence
Finding: The skill states it needs file read/write access and even documents a concrete storage path, but it does not declare an explicit tool scope or permission model in metadata. That mismatch can lead to overbroad or implicit filesystem access, making it harder to enforce least privilege and easier for an agent runtime to grant more access than users expect.

Vague Triggers

Medium

Confidence: 91% confidence
Finding: The trigger keywords are very broad and overlap with common language-learning requests such as querying word meanings or asking for vocabulary help. This can cause unintended invocation, which is a security and safety concern when a skill has file access and scheduled behavior, because users may activate it without realizing the side effects.

Missing User Warnings

Medium

Confidence: 88% confidence
Finding: The skill advertises scheduled daily pushes and reminders without clearly warning about proactive notifications or recurring background behavior. Users may unknowingly enable persistent reminders, which can create privacy, consent, and nuisance risks, especially if combined with saved learning history and configurable schedules.

Natural-Language Policy Violations

Medium

Confidence: 96% confidence
Finding: The module description and all user-facing responses are written in Chinese, and the trigger handling expects Chinese query terms such as “开始”, “学习”, and “测试”. This imposes a specific language/locale on users without offering an explicit language choice or documenting a justified locale restriction.

Missing User Warnings

Low

Confidence: 89% confidence
Finding: This code updates and saves user learning preferences and progress to progress.json via save_json, but there is no confirmation prompt, user-facing disclosure, or nearby comment explaining that the skill persists data locally. Because this is a code file, file writes that store user data should include some visible warning unless the persistence behavior is clearly disclosed.

Static analysis

No suspicious patterns detected.