Ae4
Medium
- Category
- analysis-evasion
- Confidence
- 80% confidence
- Finding
Suspicious Unicode normalization or mixed-script content
- Content
Security audit
DingJi Course Design
Security checks for vulnerabilities and agentic risk
Overview
This math course-design skill is not malicious, but it asks agents to use persistent memory, scheduled reminders, subagents, command execution, uploads, and messaging without clear consent boundaries.
Install only if you want a Chinese higher-math course-design assistant that may track learning progress, schedule review reminders, use subagents, run math scripts, and send progress reminders. Before using it, require confirmation before any Memory write, cron setup, upload, external message, or exec/Python run, and ask for the output language you prefer.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Vulnerability Patterns
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (8)
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The trigger description uses broad phrases like 'design math course' and 'create teaching plan', which are generic and likely to overlap with ordinary user requests. This can cause the skill to activate unintentionally in contexts where the user did not explicitly request this workflow, increasing the risk of prompt-scope hijacking, unwanted tool orchestration, or inappropriate handling of user data within the skill's multi-agent/memory flows.
- Content
Ae4
Medium
- Category
- analysis-evasion
- Confidence
- 80% confidence
- Finding
Suspicious Unicode normalization or mixed-script content
- Content
Ae4
Medium
- Category
- analysis-evasion
- Confidence
- 80% confidence
- Finding
Suspicious Unicode normalization or mixed-script content
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
This markdown file is entirely written in Chinese, including the title, headings, explanations, and examples, with no indication that users may choose another language or that the content is intentionally limited to a Chinese-speaking audience. Under the policy, forcing a specific language without opt-in is a natural-language policy violation.
- Content
Ae4
Medium
- Category
- analysis-evasion
- Confidence
- 80% confidence
- Finding
Suspicious Unicode normalization or mixed-script content
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The template explicitly requires key transformations to be annotated in Chinese, which can override or constrain the agent's language behavior without considering user preference. While not a code-execution risk, this can degrade usability, accessibility, and policy compliance in multilingual settings by forcing outputs into a language the user may not understand.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
This markdown file contains natural-language instructional content exclusively in Chinese, beginning at L001 and continuing throughout the document. Under the policy rule for language/locale, forcing a specific language without user opt-in can be a violation when no alternative or justification is provided.
- Content
Static analysis
No suspicious patterns detected.