T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/mistakes.py:18- Finding
Student Records Are Persisted Without Explicit Restrictive File Permissions
- Content
View full analysis
- Remediation
View remediation
Security audit
高考助手 Gaokao Tutor
Security checks for vulnerabilities and agentic risk
Overview
This Gaokao tutoring skill is mostly purpose-aligned, but it needs review because it stores student profile data persistently and gives inadequate guidance for explicit self-harm language.
Install only if you are comfortable with a local tutor that remembers student profile and mistake data across sessions. Users should be told where that data is stored and how to delete it. The emotional-support section should be fixed before use with vulnerable students: explicit self-harm or suicide language should trigger immediate crisis-oriented guidance to contact local emergency services or a trusted adult, not ordinary study-stress reassurance.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)
other
Error
- Location
references/emotional-support.md:23- Finding
Explicit Suicidal Language Is Handled Without Crisis Assessment or Escalation
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (24)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 96% confidence
- Finding
The code only implements one narrow subset of the declared description: mistake tracking/review. It provides CLI commands to add mistakes, list them, show due reviews, mark reviews complete, and display weak-point statistics, persisting data to a local JSON file under the user's home directory. While mistake tracking is mentioned in the description, the declared primary purpose is a full-featured Gaokao AI tutor with many educational capabilities that are absent here. This is a material description-behavior mismatch because the actual code is a standalone错题本 management script, not a multi-function AI tutoring system.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 96% confidence
- Finding
The supplied code does not behave like a general-purpose Gaokao tutoring assistant across subjects. Instead, it is a narrow CLI utility for querying local score data and estimating admission options. While college application guidance is loosely related to the declared mention of 志愿填报, the implementation is limited to score-line lookup and school recommendation by score bands. Most declared educational/tutoring features are absent, making the description materially broader and misleading relative to the actual code behavior.
- Content
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
This guidance explicitly includes suicidal wording ('太难了想死') yet only instructs the agent to soothe and continue conversation, without stating that the skill is not a crisis service or directing the student to immediate human help. In the context of a student-facing exam tutor, that omission is especially dangerous because distressed minors may rely on the system during an acute crisis and be delayed from reaching qualified support.
- Content
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 92% confidence
- Finding
The skill explicitly instructs reading and writing persistent files (
memory/gaokao-profile.json,memory/gaokao-mistakes.json) but declares no tool scope or permission boundaries. That creates an authorization gap: a host may expose file capabilities more broadly than intended, and users are not given clear limits on what storage actions the skill may perform.- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The trigger phrases are broad enough to match ordinary tutoring or conversational requests, which can cause this skill to activate unexpectedly. Because the skill also performs persistent memory reads/writes, overbroad activation increases the chance of collecting or storing student data in contexts where the user did not intend to invoke this skill.
- Content
Ssd 3
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
This section instructs the agent to read and reuse persistent student data across sessions, which creates privacy and profiling risk. In an education context the data may seem low sensitivity, but province, exam year, weaknesses, and study history can still be personal and longitudinally revealing, especially for minors.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The skill directs persistent storage of student profile and mistake data without a clear user-facing notice or consent flow for retention. This is risky because it collects educational profile data across sessions, and users may not realize their inputs are being written to disk and reused later.
- Content
Ssd 3
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The onboarding flow collects detailed student profile data and persists it without visible safeguards, consent, or minimization. Since this skill targets high school students, the context makes the privacy risk more serious because the system is profiling likely minors and tracking academic weaknesses over time.
- Content
Ssd 3
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
Maintaining a persistent mistake log and updating user history after interactions creates a behavioral dossier of a student's academic performance. If accessed improperly or retained indefinitely, this can expose learning weaknesses and other personal patterns beyond what users expect from a tutoring interaction.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 81% confidence
- Finding
The file is entirely written in Chinese and repeatedly frames the skill around the Chinese Gaokao context, indicating a language/locale constraint. Because no opt-in or alternative language support is mentioned here, this can constitute a natural-language policy violation under the language-choice requirement.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 86% confidence
- Finding
The design explicitly makes province and exam year mandatory profile fields for all users, which creates unnecessary collection pressure for personal contextual data without an opt-in path or a clearly documented minimization boundary. While these fields are pedagogically relevant for localized guidance, forcing collection across all interactions increases privacy risk and creates a larger retained profile surface than necessary.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
This markdown file presents all guidance in Chinese and does not indicate that the user can choose another language or that the skill is intended only for Chinese-speaking users. Under the language/locale policy rule, forcing a specific language without opt-in is a natural-language policy violation.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The trigger list for mild anxiety uses common study-frustration phrases like '好难', '好烦', and '好累' that are likely to appear in ordinary tutoring conversations. In a Gaokao tutoring skill, this can cause the agent to divert from academic help into emotional-support mode too often, creating unpredictable behavior and weakening appropriate handling boundaries for more serious distress.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The high-severity trigger list mixes vague terms like '放弃' and '崩了' with explicit self-harm language like '想死' but provides no clear escalation boundary. That ambiguity is dangerous because the system may treat suicidal ideation as just another exam-stress state and respond with general comfort instead of urgent safety-oriented guidance.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The file is entirely written as a Chinese-only instruction set, including headings, prompts, and interaction text such as the post-question flow. This imposes a specific language/locale on users without documenting a choice, opt-in, or region-specific justification, which matches the language/locale policy violation category.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The entire guide is written as a prescriptive tutoring workflow in Chinese and provides only Chinese prompt examples and output structure, with no indication that users may choose another language. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation unless the locale constraint is explicitly justified.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
This markdown file presents all instructions and templates exclusively in Chinese, and there is no indication that the user can choose another language or that the skill is intentionally limited to a Chinese-speaking audience. Per the policy criteria, forcing a specific language without user opt-in is a natural-language policy violation.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
This code’s docstring, CLI description, and runtime messages are entirely in Chinese, which imposes a specific language on users. The policy allows locale constraints only when justified or when users are given a choice, and neither is present here.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The user-facing string instructs users to send the Chinese phrase “今日复习” to access a related feature, and the rest of the CLI/help text is also exclusively in Chinese. This creates a natural-language locale constraint without opt-in or an explicit statement that the tool is intentionally limited to Chinese-speaking users.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The metadata strings are entirely in Chinese, including the description and warning text, which imposes a single language/locale in a file intended for general skill consumption. The file does not indicate that the dataset is region-specific for Chinese-speaking users only, nor does it offer any language choice or localization mechanism.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
This JSON file encodes all descriptive metadata and usage guidance in Chinese only, including the description, warning, and usage fields. For a generally reusable skill dataset, that is a natural-language locale constraint without any explicit opt-in or documented region-specific justification in the file.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 86% confidence
- Finding
This markdown file applies to SQP-3, which covers language or locale policy violations in natural-language content. The document presents all instructions and output format in Chinese without indicating user opt-in, alternative language support, or a documented reason for enforcing a single language.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 81% confidence
- Finding
This markdown file presents all instructional content in Chinese, including the title and all subject descriptions. Under the policy for natural-language violations, forcing a specific language without offering user choice can be a locale-policy issue when no opt-in or justification is provided.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
This code file contains natural-language instructions and CLI help/output entirely in Chinese, including the module docstring usage examples and subsequent user-facing messages. Under the stated policy, forcing a specific language without user opt-in is a natural-language policy violation unless a justified locale constraint is clearly documented, which is not present here.
- Content