Security audit

Gaokao Admissions

Security checks for vulnerabilities and agentic risk

Overview

This skill is a China Gaokao admissions helper that uses public web data and local reference files, with no evidence of hidden persistence, credential access, destructive behavior, or data exfiltration.

Install only if you want a Chinese-language Gaokao admissions assistant. Treat its school, rank, salary, and admission-probability outputs as estimates, and verify final decisions against official provincial exam authority and university admissions sources, especially when it uses search snippets or fallback reference data.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (8)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 94% confidence
Finding: The skill promises a comprehensive admissions recommendation workflow, but the described behavior and static findings indicate it may only perform partial search/scraping and summary rather than the claimed rank conversion, school matching, major recommendation, and planning logic. This is dangerous because users may rely on incomplete or fabricated decision support for a high-stakes educational outcome, and hidden capability gaps also make security review harder by obscuring what the skill truly does.
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 84% confidence
Finding: The skill explicitly instructs use of network-capable actions such as web_fetch/web_search and a data-fetching script, but it does not declare an explicit tool scope such as permissions or allowed-tools. That creates an authorization ambiguity where the runtime may permit broader external access than reviewers or users expect, increasing risk of unintended data egress, overbroad browsing, or future scope creep if the skill is extended.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The skill name and description are written entirely in Chinese and describe the workflow as if it will operate in that language by default, but there is no indication that users may choose another language or that the language restriction is an intentional, documented requirement. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: This markdown file contains user-facing content exclusively in Chinese, and there is no indication that the skill is limited to a Chinese-speaking audience or that users may choose another language. Under the language/locale policy, forcing a specific language without user opt-in is a natural-language policy violation.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The request header forces Accept-Language to prefer zh-CN, which is a natural-language locale constraint embedded in code. Under the policy, locale restrictions should be user-selectable or clearly justified; this file does not provide an opt-in or explain why only Chinese locale preference is appropriate.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The entire skill content is written only in Chinese and provides no indication that users can choose another language or locale. Under the policy for natural-language violations, forcing a specific language without user opt-in is in scope.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 89% confidence
Finding: This markdown file contains only Chinese-language content and does not mention any language selection, alternative locale, or scope justification. Under the policy rule for natural-language violations, forcing a specific language without user opt-in can be a locale-policy issue.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 80% confidence
Finding: This markdown file contains user-facing natural language content exclusively in Chinese and does not indicate that the skill is region-specific or that users may choose another language. Under the policy rule, forcing a specific language without user opt-in can be a locale-policy violation.
Content: No source excerpt is available for this finding.