佛学讲评助手

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 10:36 AM UTC
• Version: 2.26.0

Overview

This skill is a disclosed Buddhist audio/video lecture evaluation workflow, with manageable setup and language-normalization caveats.

Install in an isolated environment, pin and verify dependencies/models where possible, and avoid the third-party model mirror unless you trust it. Expect uploaded Traditional Chinese content to be converted to Simplified Chinese for processing and report generation.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:45

Finding

Unpinned Dependencies and Unverified Third-Party Model Mirror

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 45–46
Vulnerability Type: Supply-chain exposure through unpinned packages and third-party artifact retrieval
Risk Level: Medium

Vulnerable Code

bash

pip install -i https://pypi.tuna.tsinghua.edu.cn/simple faster-whisper soundfile
export HF_ENDPOINT=https://hf-mirror.com        # CN environment model mirror

Technical Analysis

The documented installation command obtains faster-whisper, soundfile, and their transitive dependencies without fixed versions or integrity hashes. Package installation can execute package build or installation logic with the invoking user's privileges. Because resolution is not reproducible, future releases or compromised dependencies may introduce code that was not present during this audit.

The configuration also redirects Hugging Face model retrieval to a third-party mirror without requiring checksum or signature verification. A compromised mirror, distribution channel, or upstream account could provide altered model artifacts. Depending on the model loader and artifact format, this could cause output manipulation and, where unsafe deserialization is involved, potentially code execution. The reviewed documentation does not establish that unsafe deserialization occurs, so that outcome is conditional rather than confirmed.

The risk is limited by the fact that these are transparent setup instructions rather than hidden execution logic. Nevertheless, users following them enter an inadequately controlled software and model supply chain.

Attack Path

1. An attacker compromises a package publisher, transitive dependency, configured package index, or model mirror.
2. The attacker distributes a malicious package release, dependency, or modified model artifact.
3. A user follows the documented commands without version or hash verification.
4. pip resolves and installs the attacker-controlled package content, or the transcription framework downlo ...[truncated 1126 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin every direct dependency to an audited exact version, for example through a locked requirements file.
2. Lock transitive dependencies and require cryptographic hashes with pip --require-hashes.
3. Prefer the official PyPI index and official Hugging Face endpoint. If mirrors are operationally necessary, document their trust model and use only controlled or organization-approved mirrors.
4. Publish verified SHA-256 checksums or signatures for all model files and validate them before loading.
5. Use safe model formats such as safetensors where supported, and prohibit loaders that deserialize executable Python objects.
6. Install dependencies in an isolated virtual environment or container under an unprivileged account.
7. Generate and review a software bill of materials, and continuously scan locked dependencies for known vulnerabilities.
8. Include the referenced runtime scripts in the distributed project so their download, subprocess, deserialization, temporary-file, and input-validation behavior can be audited.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (2)

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The document states that all Traditional Chinese content is uniformly converted to Simplified Chinese before all computation and comparison. This imposes a specific language/script policy on user content without offering a choice or opt-in, which matches the locale/language policy violation criterion.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The quality guardrail requires all text to be converted to Simplified Chinese immediately on read, with no Traditional Chinese retained. This is a blanket script constraint without a documented user choice or clear region-specific justification.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.