Security audit
Security checks for vulnerabilities and agentic risk
This skill is a disclosed local study-planning helper that stores narrow learning logs locally and does not show evidence of exfiltration or hidden behavior.
Before installing, be aware that study schedules, subjects, problems, and allocation inputs are saved locally by default. Use LEARNING_OPTIMIZER_HOME to isolate the data on shared machines, and delete the local JSONL files manually when they are no longer needed.
Code enumerates, copies, or searches environment variables for secrets. Bulk environment access can collect credentials unrelated to the skill's stated purpose.
def main():
with tempfile.TemporaryDirectory() as tmp:
env = os.environ.copy()
env["LEARNING_OPTIMIZER_HOME"] = str(Path(tmp) / "learning-data")
print("[verify] analyze")
The skill exposes capabilities consistent with environment access, file read/write, and shell execution, but the manifest does not declare any tool scope or permission boundaries. This creates an unsafe trust gap: users and hosting platforms cannot easily tell what the skill may access, increasing the chance of over-privileged execution and unintended local data exposure or command execution.
The usage examples and environment variable example consistently require Chinese text inputs such as "每天2小时", "数学,英语", and "容易分心", with no indication that other languages are supported or that the Chinese locale is optional. This creates a natural-language policy concern because the skill appears to impose a specific language on users without opt-in or documented justification.
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
Never:
- Guarantee performance improvement
- Impose one-size-fits-all solutions
- Collect external data without consent
- Make unrealistic promises
Always:
This code embeds user-facing labels and guidance entirely in Chinese, and later commands print Chinese-only status messages and recommendations. That forces a specific language/locale on all users without offering any opt-in or alternative, which matches the language/locale policy violation criteria.
subprocess module calls execute external commands. Without careful input validation, this enables command injection.
def run(args, env):
result = subprocess.run(
[sys.executable, str(MAIN), *args],
cwd=ROOT,
env=env,
The verification logic uses Chinese command arguments such as "每天2小时" and asserts Chinese output strings like "学习模式分析". This effectively enforces a specific language/locale in the skill behavior without any visible opt-in or justification, which matches the language/locale policy violation criteria.
The manifest sets "language": "zh", which indicates a fixed language/locale choice. Under the policy, forcing a specific language is a violation unless the skill offers user choice or clearly documents a justified region-specific constraint, neither of which appears here.
The skill writes user-provided study schedules, subjects, problems, and optimization data to local JSONL files, even though its stated purpose is analysis and suggestions. This creates an unnecessary persistence of potentially sensitive behavioral data and increases privacy risk if other local users, tools, or later processes can access the files.
The data command reveals the local storage directory and expected log filenames, which is outside the core learning-optimization function. While it does not directly dump contents, it exposes internal storage layout and makes discovery of persisted user data easier for anyone with command access.