Security audit
Security checks for vulnerabilities and agentic risk
The skill is a coherent Chinese teaching-material generator, but it deserves review because normal use can automatically install Python packages and send course-search queries to external search engines.
Install only if you are comfortable with a Chinese-language workflow that writes generated course files, may install Python document-generation dependencies, and may use web search for course research. Avoid putting real student data, confidential institutional materials, credentials, or unpublished sensitive course details into crawler queries or generated inputs.
A second aspect of the mismatch is that the skill exposes arbitrary export behavior via command examples that write decoded reference content to user-specified output files. When documentation presents this as part of a teaching assistant, it can enable unexpected local data materialization and broaden the attack surface beyond the stated educational function.
A second aspect of the mismatch is that the skill exposes arbitrary export behavior via command examples that write decoded reference content to user-specified output files. When documentation presents this as part of a teaching assistant, it can enable unexpected local data materialization and broaden the attack surface beyond the stated educational function.
The trigger policy is intentionally broad and tells the agent to proactively invoke the skill even when explicit keywords are absent, based only on a loose interpretation of user intent. In a multi-skill environment, this can cause over-invocation, unnecessary tool use, and accidental access to local files or shell/network actions for ordinary teaching-assistance requests.
The skill instructs use of shell, file read/write, and network-capable scripts but does not declare any explicit tool scope or permission boundaries. That creates an authorization gap where a host agent may grant broader capabilities than users expect, increasing the risk of unintended file access, dependency installation, or outbound network use.
The invocation guidance uses very broad natural-language examples that overlap with common educational support requests, making accidental triggering more likely. While not inherently malicious, this increases the chance that a high-capability skill is selected when a simpler non-tool response would suffice.
Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
{"混合式教学设计方案模版.docx": "UEsDBBQABgAIAAAAIQBbe3i3oAEAAJAHAAATAAgCW0NvbnRlbnRfVHlwZXNdLnhtbCCiBAIooAACAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAC0VcFu2zAMvQ/YPxi6DrHSHYZhiNPDth63AuuAXRWJToRJoiAybfP3o+PEGIakbpf6YsDm43uPFPS8uH6MobqHQh5To67quaogWXQ+rRv18+5m9lFVxCY5EzBBo3ZA6nr59s3ibpeBKulO1KgNc/6kNdkNREM1ZkhSabFEw/Ja1job+9usQb+fzz9oi4kh8Yw7DrVcfIHWbANXXx/lc+8EHXOrqs89shNrlMk5eGtYAPo+uX9kZti23oJDu43SUuOq3ZKgwd0IidInZQoEepnKYZBaOvcY2vhM7wRwRqGrnBc49H2XEyjeQXVrCn8zUVD6AYvTwzRP04xvo2PLBS0QydHGUA+VaHw6+j/lw26JMf6KQXuGeFsw09XFdgbSjg8Kexh2eHYXxLsA9Pqb6HnH5YFZGqYwcGAetfAAqx+TufiLfNRIi8gJeYrTGKhHTUByE3k4Mj9jD6JoVgGm2MOBetQES+hC/7z8Yu5pnpIU5D4DJMTLf4x9jM+ue5afdfkHRaG+eD7oktmBe6l2H1ivlHsnxPX+f7r8AwAA//8DAFBLAwQUAAYACAAAACEAmVV+Bf4AAADhAgAACwAIAl9yZWxzLy5yZWxzIKIEAiigAAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
...[truncated 28 chars]
The only visible natural-language metadata in this file is Chinese template naming, such as the document titles, and there is no indication that users can choose another language or locale. For all file types, forcing a language-specific experience without documented opt-in can violate language or locale policy.
The module docstring and all runtime status messages are written only in Chinese, which imposes a specific language on users and operators. Under the policy, language constraints should either provide opt-in/choice or be clearly justified as region-specific; neither is present here.
Spawning pip through subprocess gives the skill an execution path for modifying the Python environment and invoking external package-management behavior. Even though the current arguments are fixed, this capability is broader than needed for generating teaching artifacts and can facilitate persistence, environment tampering, or execution of untrusted package install hooks.
The script executes pip via subprocess to install packages at runtime. Although the command arguments are hardcoded and not directly user-controlled, this still introduces process-execution capability and enables fetching and installing code into the environment, which increases attack surface and can be abused if package sources or environment trust boundaries are compromised.
def pip(args):
return subprocess.run([sys.executable, "-m", "pip", "install", "--quiet"] + args)
def install_from_vendor(pip_name):
This bootstrap logic performs network installation from PyPI for python-docx and python-pptx when dependencies are absent. For an instructional-design skill, downloading and installing executable third-party packages at runtime is not essential to the declared business function and creates a supply-chain risk: a compromised dependency, dependency confusion, or hostile network environment could lead to arbitrary code execution in the host environment.
A shared utility for instructional-design output should not silently modify the Python environment by invoking a bootstrap installer. This exceeds the stated skill purpose and creates a supply-chain and arbitrary code execution risk path if the bundled bootstrap script or its package sources are tampered with.
The code auto-installs dependencies without warning or consent at the moment of execution. Silent environment changes are dangerous because users may trigger package installation and execution of additional code merely by using a helper function, undermining informed trust and making unexpected network/package-manager activity possible.
The helper automatically spawns a second Python script to install missing dependencies at runtime. Although it does not use a shell and the target path is fixed relative to the package, it still causes code execution and environment modification without explicit user consent, which is risky in a document-generation skill and expands the trust boundary to whatever _bootstrap_deps.py does.
pass
try:
import subprocess
r = subprocess.run(
[sys.executable, os.path.join(SCRIPTS_DIR, "_bootstrap_deps.py")],
cwd=PKG_ROOT,
)
This code file contains natural-language strings that define usage, behavior, and remediation guidance only in Chinese. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation unless the locale restriction is explicitly justified, which is not stated here.
subprocess module calls execute external commands. Without careful input validation, this enables command injection.
"""执行一个子脚本，返回返回码。末尾附加 --from-build 标记让子脚本自检转静默（build 已统一校验）。"""
cmd = [sys.executable, os.path.join(SCRIPTS, script)] + list(args) + ["--from-build"]
print("\n>> 运行：%s" % " ".join(os.path.basename(str(c)) for c in cmd))
return subprocess.run(cmd).returncode
def run_with_retry(script, *args):
Auto-running an installation flow exceeds the minimally necessary behavior for generating teaching design artifacts and introduces environment-changing side effects. In the context of a skill package that should be treated as untrusted, this increases the attack surface because dependency installation can execute arbitrary setup logic or fetch unreviewed code.
The build script will automatically launch _bootstrap_deps.py when imports fail, giving the skill package the ability to modify the host environment and install software. In an untrusted skill context, auto-install behavior is risky because it expands execution beyond document generation and can be abused to run unexpected code or pull packages from the network.
except ImportError:
notes.append(("fix", "运行依赖缺失，正在尝试自动安装……"))
try:
r = subprocess.run([sys.executable, os.path.join(SCRIPTS, "_bootstrap_deps.py")],
cwd=os.path.dirname(SCRIPTS))
if r.returncode == 0:
notes.append(("ok", "依赖已自动安装完成"))
Forcing a Chinese Accept-Language preference leaks a user/environment attribute to third-party services and removes user control over localization. While not directly leading to code execution, it is a privacy issue because it unnecessarily discloses regional or language preferences in outbound requests.
The script transmits raw user-supplied search queries to external search engines, which can expose sensitive course plans, internal terminology, personal data, or proprietary prompts to third parties without any explicit warning or consent flow. In this skill context, users may paste unpublished teaching materials or institution-specific information, making inadvertent data disclosure more plausible.
Hard-coding the Bing setlang=zh-CN parameter similarly forces locale disclosure to an external provider without user choice. In an educational-content crawler this is somewhat contextual and likely intended to improve result relevance, but it still creates avoidable privacy leakage and may bias results in ways the user did not request.
This file's natural-language interface is entirely in Chinese, including the primary description and usage guidance, with no indication that the skill is region-specific or that another language can be used. That creates a language/locale policy concern under the rule for forced language without user opt-in.
The generated HTML hard-codes lang="zh-CN", which imposes a specific language/locale on all output. The file also uses Chinese-only user-facing strings throughout, and there is no opt-in, fallback, or documented justification that this skill is region-specific.
The module docstring, usage instructions, and all user-facing messages are written exclusively in Chinese, which imposes a specific language on users. Under the policy, locale restrictions should either offer user choice or clearly document why the restriction is necessary; this file does neither.
The file’s user-facing docstring, status messages, and remediation guidance are entirely in Chinese, including directions to send the output to WorkBuddy. This creates a natural-language locale constraint for users without any stated opt-in, alternative language, or justification that the skill is region-specific.
No suspicious patterns detected.