Security audit

Guided Learning

Security checks for vulnerabilities and agentic risk

Overview

This tutoring skill appears purpose-built, but it automatically stores detailed learning history and uses user materials with online research without clear opt-in or deletion controls.

Install only if you are comfortable with the agent keeping subject-specific study records. Avoid uploading confidential coursework, employer documents, private notes, or proprietary PDFs unless you have permission, and ask the agent not to store progress or not to use online search for sensitive material.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (13)

Missing User Warnings

Medium

Confidence: 92% confidence
Finding: The README states that the skill writes persistent study-progress data to subject-specific memory files, but it does not warn users that their learning history, mistakes, and other educational metadata will be retained. That creates a privacy and consent gap: users may disclose sensitive academic, personal, or work-related material without understanding it will be stored across sessions.

Ssd 3

Medium

Confidence: 90% confidence
Finding: Persistent subject-specific study files create a natural-language data retention risk because they may accumulate learning history, inferred weaknesses, and user-provided content over time. Even if intended for convenience, this increases exposure if the memory store is later accessed by other tools, users, or prompts.

Missing User Warnings

Medium

Confidence: 94% confidence
Finding: The material-first workflow instructs the skill to request user documents and cross-reference them online without any privacy warning or scope limitation. This can lead users to upload copyrighted, confidential, or personally sensitive materials that may then be processed more broadly than expected.

Ssd 3

Medium

Confidence: 91% confidence
Finding: Requiring users to provide materials and analyzing them before teaching broadens data collection beyond what is strictly necessary for a tutoring interaction. In context, this is more dangerous because educational materials can include proprietary coursework, employer documents, or personally identifying annotations, and the README does not constrain or sanitize that intake.

Ssd 3

Medium

Confidence: 96% confidence
Finding: The memory tracking design explicitly calls for automatic logging of mistakes, weak points, chapter progress, and session history at multiple points, creating a detailed behavioral profile of the user. While useful pedagogically, this persistent profiling can reveal sensitive traits or performance patterns and becomes riskier because it is automatic, recurring, and not described as user-controllable.

Missing User Warnings

Medium

Confidence: 89% confidence
Finding: The skill instructs the agent to use network search together with user-provided materials to ensure understanding, but it does not warn users that their uploaded content, excerpts, or derived details could be disclosed to external services. If implemented naively, this can leak proprietary textbooks, class materials, or sensitive notes outside the local environment without informed consent.

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: The skill explicitly states it will automatically record learning progress, mistakes, weak points, and session continuation state into per-subject memory files, but the README does not clearly disclose this as persistent storage requiring user awareness or consent. This creates a privacy risk because sensitive educational data, inferred weaknesses, or personal study history may be retained longer than users expect and later exposed to other tools, sessions, or operators.

Ssd 3

Medium

Confidence: 93% confidence
Finding: The documented memory system preserves long-term natural-language records of learned topics, errors, weak points, review history, and resume state in subject-specific files. Such retained educational profiles can accumulate sensitive behavioral data and may be surfaced in later contexts, creating confidentiality and over-retention risks even if the feature is intended to improve tutoring continuity.

Description-Behavior Mismatch

Medium

Confidence: 89% confidence
Finding: The manifest presents the skill as guided tutoring, but the workflow expands into active online research and external cross-referencing. That creates a capability and data-flow mismatch: users may expect explanation of provided materials, while the agent is instructed to fetch outside information that could introduce unvetted content, leak sensitive study topics, or exceed expected permissions.

Description-Behavior Mismatch

Medium

Confidence: 95% confidence
Finding: The skill includes persistent learner profiling, performance tracking, and session-history management that are not disclosed in the top-level description. This hidden expansion of behavior is risky because it normalizes long-term storage of sensitive educational data without clear expectation-setting, increasing privacy and misuse risk.

Missing User Warnings

Medium

Confidence: 96% confidence
Finding: The skill instructs proactive writing of detailed learning progress to memory without clearly warning the user that their data will be stored persistently. This undermines informed consent and can lead to collection of sensitive educational or personal information that the user did not realize would be retained across sessions.

Ssd 3

Medium

Confidence: 97% confidence
Finding: The skill mandates persistent recording of goals, mistakes, performance, weak points, and study history without minimization, purpose limitation, or consent boundaries. This creates a substantial privacy risk because the stored data can reveal cognitive patterns, academic struggles, schedules, and potentially sensitive subject matter, all of which may be unnecessary for the core tutoring function.

Context-Inappropriate Capability

Medium

Confidence: 93% confidence
Finding: The skill directs the agent to create and maintain per-subject memory files containing detailed study history, errors, mastery, and schedules. Persistent file creation is not strictly necessary for guided tutoring and broadens the attack surface by accumulating sensitive user data that could later be exposed, reused out of context, or retained longer than intended.

Static analysis

No suspicious patterns detected.