成都初升高专家

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 8:22 AM UTC
• Version: 1.0.1

Overview

This is a coherent Chengdu school-admissions advice skill with privacy and source-verification cautions, but no hidden, destructive, or unrelated behavior.

Use this as advisory planning support, not as an official decision source. Share only the minimum needed details, avoid names, ID numbers, exact addresses, and unnecessary school identifiers, approve any case logging first, and verify policies, deadlines, eligibility rules, and score cutoffs through current official education bureau or school notices before acting.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:166

Finding

Unencrypted Retrieval of External Policy Content

Content

View full analysis

Vulnerability Details

File Locations:

• SKILL.md:166
• references/policy-2026.md:8
• references/policy-2026.md:158-159
• references/primary-school-policy.md:9

Vulnerability Type: External content retrieved over plaintext HTTP
Risk Level: Medium

Vulnerable Code Snippets

SKILL.md:166 directs the agent to use:

text

web_fetch

The configured external sources use these plaintext URLs:

text

http://edu.chengdu.gov.cn
http://www.cdzk.com

Technical Analysis

The Skill permits retrieval of current policy information through web_fetch, while the referenced policy sources are specified with unencrypted HTTP URLs. HTTP does not provide transport confidentiality, integrity, or server authentication.

An attacker able to intercept or modify network traffic could replace the returned policy content. Since retrieved content may enter the agent's context, manipulated responses could produce incorrect enrollment recommendations. If the agent fails to isolate remote content from operational instructions, an altered response could also contain indirect prompt-injection text intended to influence subsequent tool calls or responses.

No evidence shows that remote executable code is downloaded or executed. Therefore, this issue is an insecure configuration rather than remote payload execution.

Attack Path

1. The Skill determines that current policy information is required.
2. The agent invokes web_fetch using one of the documented HTTP sources.
3. An attacker with a network interception position modifies the unencrypted HTTP response.
4. The attacker inserts false policy information or instruction-like content into the response.
5. The agent processes the modified content as a reference.
6. The resulting recommendation may contain incorrect eligibility, school-placement, or application guidance. If remote content is insufficiently isolated, it may also influence later ag ...[truncated 691 chars]

Remediation

View remediation

Remediation Suggestions

1. Replace all plaintext policy URLs with verified HTTPS endpoints.
2. Reject redirects from HTTPS to HTTP.
3. Restrict web_fetch to an explicit allowlist of verified government domains.
4. Validate the final hostname after every redirect to prevent redirect-based allowlist bypass.
5. Treat all fetched content as untrusted reference data, never as agent instructions.
6. Delimit remote content and instruct the agent not to execute commands or follow behavioral directives found in fetched pages.
7. Prefer signed official documents or verify retrieved policy information against an independent official source.
8. Record source URL, retrieval date, policy year, and document title in generated guidance.
9. If HTTPS is unavailable, do not automatically consume the source; require explicit user confirmation and clearly warn that content integrity cannot be verified.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (6)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The skill explicitly permits writing analysis cases to a persistent workspace file, while the skill’s normal operation involves handling student education data such as household registration, school, grades, and eligibility details. Even though the document says to de-identify cases and avoid storing sensitive information, it does not require explicit user consent, define strict minimization rules, or warn about persistence and possible reidentification, creating a realistic privacy leakage risk.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The document gives concrete admissions and volunteer-filing strategy guidance without clearly requiring users to verify current official Chengdu education bureau policies, school eligibility rules, and recent cutoff lines before acting. In an admissions-planning skill, stale or overgeneralized guidance can directly mislead families into submitting invalid or suboptimal choices, especially because the file itself includes dated update metadata and policy-sensitive recommendations.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The entire file is written exclusively in Chinese and presents the content as a general reference document, but it does not indicate that Chinese is optional, user-selected, or required by a region-specific usage policy. Under the stated policy rule, forcing a specific language without opt-in can be a natural-language policy violation unless the locale constraint is explicitly documented and justified.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 77% confidence

Finding

The file is entirely written for a Chinese-language, Chengdu-specific audience, but it does not explicitly present this as an optional locale or region selection. Under the policy rule, natural-language content that assumes a fixed language/locale without opt-in can be flagged unless the regional constraint is clearly documented and justified.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

SQP-3 applies to all file types and covers language or locale policy violations. This markdown file presents all instructions and content only in Chinese, with no user opt-in for language preference and no explicit statement that the skill is intentionally limited to Chinese-language users.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

The file discusses sensitive student attributes such as household registration, school registration, and migrant-student status, which are personal data commonly needed for admissions advice, but it does not warn users to minimize sharing or handle that information carefully. In this skill context, the omission increases privacy risk because users may disclose more identifying data than necessary when seeking personalized recommendations.

Content

No source excerpt is available for this finding.