Security audit

知识学习管理

Security checks for vulnerabilities and agentic risk

Overview

This learning-review skill is mostly coherent, but it has broad automatic triggers, persistent note storage, automatic image OCR through shell commands, and some unsolicited/network behavior that users should review before installing.

Install only if you are comfortable with a study assistant that keeps local learning records, may process images with local OCR tools, may fetch external motivational content, and may send scheduled or recovered review prompts. Avoid sending screenshots or notes that contain credentials or private unrelated information, and review the stored JSON files if you need to delete retained data.

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection

Findings (11)

Context-Inappropriate Capability

High

Confidence: 95% confidence
Finding: The skill directs the agent to download user-supplied image URLs and invoke shell commands (`curl`, ImageMagick, `tesseract`, `rm`) on local files. Even if intended for OCR, this unnecessarily expands capability from knowledge management into command execution and file/network handling, creating SSRF, unsafe file processing, and command-surface risks if message metadata or URLs are attacker-controlled.

Context-Inappropriate Capability

Medium

Confidence: 87% confidence
Finding: The skill performs external web requests to third-party sites solely to fetch motivational quotes, which is not necessary for core knowledge-review functionality. This creates avoidable data exposure and supply-chain risk, as usage timing and environment metadata may leak to external services and fetched content becomes an untrusted input source.

Description-Behavior Mismatch

Medium

Confidence: 81% confidence
Finding: The file adds periodic quiz generation, answer handling, and performance tracking behavior beyond the declared manifest scope of knowledge recording/review. Scope expansion matters because hidden or under-declared behaviors can surprise users, increase stored personal data, and bypass operator expectations about what the skill is allowed to do.

Context-Inappropriate Capability

Medium

Confidence: 84% confidence
Finding: The skill is designed to inject missed scheduled pushes during unrelated later conversations, extending itself beyond explicit trigger contexts. That can cause unsolicited outputs, context confusion, and accidental processing/storage during chats where the user did not intend to invoke the skill.

Vague Triggers

High

Confidence: 96% confidence
Finding: The rule that any input containing common trigger words enters the skill, combined with 'Agent本身不过滤任何输入', makes invocation extremely broad and easy to trigger accidentally. This increases the chance that unrelated or sensitive user content is parsed, stored, or acted upon without clear intent.

Vague Triggers

High

Confidence: 94% confidence
Finding: The trigger list includes ambiguous phrases like '学了', '没有', '进度', '大纲', and image sending, which commonly appear in normal conversation. In this skill context, broad triggers are especially dangerous because matched content can lead to persistence, OCR processing, or workflow changes without a clear command boundary.

Missing User Warnings

Medium

Confidence: 90% confidence
Finding: The skill stores knowledge entries, project data, and review history in local JSON files but does not clearly warn users in its description that their learning content is retained persistently. This can lead to unintentional collection of sensitive study notes, schedules, or personal performance history under incomplete user awareness.

Missing User Warnings

High

Confidence: 95% confidence
Finding: The skill downloads user images, preprocesses them locally, performs OCR, and may store extracted text, yet provides no clear privacy warning or consent flow for this handling. Images often contain sensitive notes, screenshots, or unrelated personal information, so silent OCR plus retention materially increases privacy risk.

Missing User Warnings

Medium

Confidence: 86% confidence
Finding: The skill makes third-party web requests for greetings without warning users that external services may observe request timing and other metadata. While the fetched content is low sensitivity, the undisclosed network behavior is still a privacy and transparency issue.

Ssd 3

Medium

Confidence: 91% confidence
Finding: The OCR flow directs the agent to extract text from user images and then store those results into persistent knowledge files, with no privacy filtering or content minimization. Because screenshots and notes can contain credentials, personal data, or unrelated sensitive text, this creates a straightforward retention path for sensitive information.

Ssd 3

Medium

Confidence: 90% confidence
Finding: The instruction that the agent should not filter any triggered input, combined with broad triggers and persistent storage features, creates a natural-language path for collecting and retaining sensitive user content. In this context, the danger is amplified because accidental invocation can turn ordinary chat text into stored records.

Static analysis

No suspicious patterns detected.