成都初升高专家

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 8:22 AM UTC
• Version: 1.0.1

Overview

This is a coherent Chengdu school-admissions advice skill with privacy and source-verification cautions, but no hidden, destructive, or unrelated behavior.

Use this as advisory planning support, not as an official decision source. Share only the minimum needed details, avoid names, ID numbers, exact addresses, and unnecessary school identifiers, approve any case logging first, and verify policies, deadlines, eligibility rules, and score cutoffs through current official education bureau or school notices before acting.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:166
• Finding: Unencrypted Retrieval of External Policy Content## Vulnerability Details **File Locations**: - `SKILL.md:166` - `references/policy-2026.md:8` - `references/policy-2026.md:158-159` - `references/primary-school-policy.md:9` **Vulnerability Type**: External content retrieved over plaintext HTTP **Risk Level**: Medium ### Vulnerable Code Snippets `SKILL.md:166` directs the agent to use: ```text web_fetch ``` The configured external sources use these plaintext URLs: ```text http://edu.chengdu.gov.cn http://www.cdzk.com ``` ### Technical Analysis The Skill permits retrieval of current policy information through `web_fetch`, while the referenced policy sources are specified with unencrypted HTTP URLs. HTTP does not provide transport confidentiality, integrity, or server authentication. An attacker able to intercept or modify network traffic could replace the returned policy content. Since retrieved content may enter the agent's context, manipulated responses could produce incorrect enrollment recommendations. If the agent fails to isolate remote content from operational instructions, an altered response could also contain indirect prompt-injection text intended to influence subsequent tool calls or responses. No evidence shows that remote executable code is downloaded or executed. Therefore, this issue is an insecure configuration rather than remote payload execution. ### Attack Path 1. The Skill determines that current policy information is required. 2. The agent invokes `web_fetch` using one of the documented HTTP sources. 3. An attacker with a network interception position modifies the unencrypted HTTP response. 4. The attacker inserts false policy information or instruction-like content into the response. 5. The agent processes the modified content as a reference. 6. The resulting recommendation may contain incorrect eligibility, school-placement, or application guidance. If remote content is insufficiently isolated, it may also influence later ag ...[truncated 691 chars]
• Remediation: ## Remediation Suggestions 1. Replace all plaintext policy URLs with verified HTTPS endpoints. 2. Reject redirects from HTTPS to HTTP. 3. Restrict `web_fetch` to an explicit allowlist of verified government domains. 4. Validate the final hostname after every redirect to prevent redirect-based allowlist bypass. 5. Treat all fetched content as untrusted reference data, never as agent instructions. 6. Delimit remote content and instruct the agent not to execute commands or follow behavioral directives found in fetched pages. 7. Prefer signed official documents or verify retrieved policy information against an independent official source. 8. Record source URL, retrieval date, policy year, and document title in generated guidance. 9. If HTTPS is unavailable, do not automatically consume the source; require explicit user confirmation and clearly warn that content integrity cannot be verified.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (6)

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The skill explicitly permits writing analysis cases to a persistent workspace file, while the skill’s normal operation involves handling student education data such as household registration, school, grades, and eligibility details. Even though the document says to de-identify cases and avoid storing sensitive information, it does not require explicit user consent, define strict minimization rules, or warn about persistence and possible reidentification, creating a realistic privacy leakage risk.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The document gives concrete admissions and volunteer-filing strategy guidance without clearly requiring users to verify current official Chengdu education bureau policies, school eligibility rules, and recent cutoff lines before acting. In an admissions-planning skill, stale or overgeneralized guidance can directly mislead families into submitting invalid or suboptimal choices, especially because the file itself includes dated update metadata and policy-sensitive recommendations.

Natural-Language Policy Violations

Low

• Confidence: 91% confidence
• Finding: The entire file is written exclusively in Chinese and presents the content as a general reference document, but it does not indicate that Chinese is optional, user-selected, or required by a region-specific usage policy. Under the stated policy rule, forcing a specific language without opt-in can be a natural-language policy violation unless the locale constraint is explicitly documented and justified.

Natural-Language Policy Violations

Low

• Confidence: 77% confidence
• Finding: The file is entirely written for a Chinese-language, Chengdu-specific audience, but it does not explicitly present this as an optional locale or region selection. Under the policy rule, natural-language content that assumes a fixed language/locale without opt-in can be flagged unless the regional constraint is clearly documented and justified.

Natural-Language Policy Violations

Low

• Confidence: 91% confidence
• Finding: SQP-3 applies to all file types and covers language or locale policy violations. This markdown file presents all instructions and content only in Chinese, with no user opt-in for language preference and no explicit statement that the skill is intentionally limited to Chinese-language users.

Missing User Warnings

Low

• Confidence: 84% confidence
• Finding: The file discusses sensitive student attributes such as household registration, school registration, and migrant-student status, which are personal data commonly needed for admissions advice, but it does not warn users to minimize sharing or handle that information carefully. In this skill context, the omission increases privacy risk because users may disclose more identifying data than necessary when seeking personalized recommendations.

Static analysis

No suspicious patterns detected.