Security audit

Curriculum Standard

Security checks for vulnerabilities and agentic risk

Overview

This is a curriculum-document generation skill with disclosed, purpose-aligned document parsing and optional public teaching-standard retrieval, but users should review network use and draft placeholders.

Install only if you are comfortable letting the agent read your training-plan/course files and, when you approve it, fetch a matched public teaching-standard PDF. Treat generated curriculum standards as drafts: check any placeholders, inferred sections, and retained intermediate files/logs before using the document officially.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (6)

Description-Behavior Mismatch

Medium

Confidence: 87% confidence
Finding: The skill’s documented behavior includes automatically matching and then downloading external ministry PDF files, which expands the trust boundary beyond user-supplied inputs. Even if the source is intended to be official, undeclared remote retrieval can expose the agent to SSRF-style fetches, malicious or unexpected content, and privacy or policy issues if users are unaware external access will occur.

Context-Inappropriate Capability

Medium

Confidence: 90% confidence
Finding: The workflow contains direct network-fetch logic using requests.get on a URL derived from matched metadata, but the skill is presented primarily as a document-generation tool. That mismatch increases risk because operators may not expect outbound network activity, and any compromise or poisoning of the index or URL field could lead to retrieval of hostile documents or unintended destinations.

Intent-Code Divergence

Medium

Confidence: 78% confidence
Finding: The skill’s validation rules say missing key information must not be guessed or defaulted, but the fallback later allows generation with placeholders when basic information is unavailable. This inconsistency can produce fabricated or misleading official-looking documents, weakening integrity controls and making it easier to smuggle unverifiable content into the output.

Intent-Code Divergence

Medium

Confidence: 75% confidence
Finding: The workflow requires the user to choose a learning-scenario template, but the later fallback permits substituting another or simplified template without that same confirmation standard. This undermines user intent and can silently change document scope or omit required sections, reducing output reliability and policy compliance.

Vague Triggers

Medium

Confidence: 72% confidence
Finding: The trigger list includes broad educational keywords such as 课程标准, 教学评价, and 课程建设, which can cause the skill to activate in contexts far beyond its narrowly intended workflow. Over-broad invocation raises the chance that the agent performs file loading, template selection, or remote standard-matching in unintended situations.

Missing User Warnings

Medium

Confidence: 89% confidence
Finding: The skill description does not prominently warn users that it may download external files from ministry-linked PDF URLs during automatic matching. Lack of disclosure is dangerous because it hides outbound data-flow and content-ingestion behavior that affects privacy, trust, and attack surface.

Static analysis

No suspicious patterns detected.