Security audit

备课

Security checks for vulnerabilities and agentic risk

Overview

This skill is a disclosed lesson-preparation guide whose file editing and asset-handling notes are mostly aligned with creating teaching materials.

Install this for help drafting and revising programming lesson materials. Keep it limited to the course workspace, explicitly approve any image-generation API use or database update, and do not let it modify its own skill documents unless you are intentionally maintaining the skill.

SkillSpector

Vulnerability Patterns

Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (4)

Description-Behavior Mismatch

Medium

Confidence: 84% confidence
Finding: The skill is presented as a lesson-preparation guidance framework, but these lines introduce operational rules for ingesting files into a database and selecting file formats. That expands the skill from pedagogical guidance into content-handling behavior that could cause the agent to process or persist artifacts beyond the user's reasonable expectations, increasing the risk of unintended data exposure or scope creep.

Context-Inappropriate Capability

Medium

Confidence: 90% confidence
Finding: These lines define file-selection and database-addition rules that are not necessary for a lesson-preparation assistant. Unjustified ingestion logic can lead an agent to pull in and retain local content automatically, which creates avoidable risk around overcollection, accidental indexing of sensitive material, and actions outside the skill's stated purpose.

Description-Behavior Mismatch

Medium

Confidence: 92% confidence
Finding: The skill is presented as a lesson-preparation framework, but this section expands its scope into concrete file, link, and database-update operations such as `update_item.py`, backups, renames, and content synchronization. That mismatch can cause an agent to perform unintended workspace modifications or administrative actions beyond the user’s educational request, increasing the risk of over-privileged behavior and unsafe side effects.

Context-Inappropriate Capability

Medium

Confidence: 95% confidence
Finding: This section includes database manipulation rules, shell-style backup commands (`cp file.md file.md.bak`), and procedural file operations that are not necessary for generating teaching materials. In an agent setting, such instructions can normalize destructive or unauthorized modifications to local content and metadata, especially if the runtime has filesystem or tool access.

Static analysis

No suspicious patterns detected.