Teaching Plan Generator

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 10:02 AM UTC
• Version: 0.1.0

Overview

This skill is a disclosed lesson-plan generator that uses user-provided teaching materials and document tools in ways that fit its purpose, with some installation and data-scope cautions.

Install this only if you are comfortable letting it process the teaching documents, local paths, or knowledge-base items you explicitly provide. For safer use, confirm each source before parsing and install the listed Python packages from a trusted, pinned environment.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:420

Finding

Unpinned Third-Party Dependencies Installed from Mutable Package Sources

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 420–433
Vulnerability Type: Supply-chain risk from unpinned dependencies
Risk Level: Medium

Vulnerable Code

markdown

## Dependencies

| 依赖 | 用途 | 安装命令 |
|------|------|----------|
| `python-docx` | DOCX 文件生成 + DOCX 参考材料读取 | `pip install python-docx` |
| `pdfplumber` | PDF 参考材料文本提取（首选） | `pip install pdfplumber` |
| `PyMuPDF` | PDF 参考材料文本提取（备选） | `pip install PyMuPDF` |
| `pytesseract` | 图片格式参考材料 OCR 识别 | `pip install pytesseract`（需安装 Tesseract 引擎） |
| `Pillow` | 图片预处理（缩放、去噪） | `pip install Pillow` |

Technical Analysis

The Skill instructs the runtime or operator to install third-party Python packages by name without exact version constraints, cryptographic hashes, a lockfile, or package-source restrictions. Consequently, the installed artifacts may change between executions even though the reviewed Skill remains unchanged.

An attacker who compromises an upstream package, its maintainer account, the configured package index, or the dependency-resolution path could cause a malicious distribution to be selected. Python packages may execute package-controlled build or installation logic during installation. Malicious package code could also execute later when the document-processing workflow imports the dependency.

The finding does not establish that any named package is currently malicious. The vulnerability is the mutable and unverified dependency acquisition process.

Attack Path

1. A user invokes functionality that requires DOCX, PDF, or image processing.
2. The required dependency is absent, causing the documented installation instruction to be followed.
3. pip resolves an unpinned package through the environment's configured package index and dependency graph.
4. An attacker-controlled or compromised release is selected, or a transitive dependency resolves to a malicious artifact.
5. Malicious code executes during package installation, package build, or subsequent ...[truncated 942 chars]

Remediation

View remediation

Remediation Suggestions

1. Replace direct unversioned installation commands with a reviewed requirements or lock file containing exact versions.
2. Generate and enforce cryptographic hashes, for example by installing with pip install --require-hashes -r requirements.txt.
3. Pin direct and transitive dependencies after reviewing the complete resolved dependency graph.
4. Configure pip to use an approved package index and explicitly disable untrusted supplemental indexes.
5. Download and scan dependency artifacts in a controlled build pipeline, then install from an internal immutable artifact repository.
6. Run document parsers in an isolated, least-privilege environment without credentials or unnecessary filesystem and network access.
7. Enable automated dependency and vulnerability monitoring, but require review and lockfile regeneration before accepting upgrades.
8. Avoid installing packages dynamically during Skill execution; provision reviewed dependencies before the Agent handles untrusted documents.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The trigger description is broad enough to activate on many generic teaching-related requests, increasing the chance this skill runs in contexts the user did not specifically intend. Over-broad activation can expose user-provided documents, local paths, or knowledge-base content to unnecessary processing and can cause the agent to take higher-risk actions such as file access based on a loosely matched request.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The skill instructs the agent to read user-uploaded files, local file paths, and knowledge-base documents without an explicit notice, consent step, or scope restriction. This creates a real data-access risk: a loosely triggered skill could ingest sensitive local files or KB content the user did not realize would be accessed, especially because the workflow also encourages automatic parsing before full parameter confirmation.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.