K12 Teacher

• Outcome: Pass
• Latest audit: Sep 22, 2026 · 12:09 AM UTC
• Version: 0.1.0

Overview

This is a disclosed K-12 teaching reference skill with validation scripts, and I found no hidden credential access, persistence, remote execution, or destructive behavior.

Before installing, confirm that an English-language, China/MOE-oriented K-12 curriculum skill matches your intended teaching context. Treat generated lessons as educational support, review factual content before use with students, and only enable any future scheduled update workflow after reviewing the script and source list.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (17)

Credential Access

High

• Category: Privilege Escalation

Content

# ============================================

# Environment variables
.env
.env.local
.env.*.local

• Confidence: 60% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

# Environment variables
.env
.env.local
.env.*.local

# Secrets and credentials

• Confidence: 60% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Self-Modification

High

• Category: Rogue Agent

Content

```
Step 6:  Write references/method-patterns.md (all code templates and instructional strategies)
Step 7:  Write SKILL.md (index and quick-reference, under 200 lines)
Step 8:  Write prompts/01-implement-method.md
Step 9:  Write prompts/02-robustness-checks.md
Step 10: Write tests/test-cases.md

• Confidence: 95% confidence
• Finding: The skill explicitly instructs the agent to create and modify multiple project files, including runtime entrypoints such as SKILL.md and validation scripts. In an agentic environment, this is a self-modification capability that can be abused to persist prompt injections, alter future behavior, or weaken safety checks, making the skill materially more dangerous than a read-only educational reference.

Natural-Language Policy Violations

Medium

• Confidence: 95% confidence
• Finding: The checklist explicitly states 'All content is in English (C-02)'. This is a natural-language locale policy that mandates a single language without presenting it as user opt-in or documenting a region-specific justification.

Natural-Language Policy Violations

Medium

• Confidence: 88% confidence
• Finding: The description says content is organized to align with Ministry of Education (教育部) standards, which implies a specific educational locale or national standard. Because the README does not clearly scope the skill to that region or offer users a choice of curriculum/locale, this is a natural-language locale policy concern.

Natural-Language Policy Violations

Medium

• Confidence: 95% confidence
• Finding: Line L028 states that all source and documentation files must be in English, and L010/L013 reinforce English as the language for compilation/runtime. This is a natural-language policy constraint that forces a specific language rather than offering a user or maintainer choice, and the file does not justify it as a necessary region-specific compliance requirement.

Natural-Language Policy Violations

Medium

• Confidence: 93% confidence
• Finding: The metadata specifies both "Language" and "Compilation Language" as English, which reads as a fixed language requirement rather than a user-selectable preference. Under the policy, forcing a specific language without opt-in is a natural-language locale violation unless clearly justified or optional.

Session Persistence

Medium

• Category: Rogue Agent

Content

### For Cognitive Level Misalignment:

- Identify whether the content is too simplistic or too complex
- Suggest specific adjustments to raise or lower the cognitive demand
- Provide example rewording of questions or explanations at the correct level

• Confidence: 75% confidence
• Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Natural-Language Policy Violations

Medium

• Confidence: 94% confidence
• Finding: Line L130 states a constraint of "English only," which is a natural-language locale policy enforced by the skill documentation. The file does not provide an opt-in, user choice, or a clear region-specific justification for restricting language output in this way.

Intent-Code Divergence

Medium

• Confidence: 93% confidence
• Finding: Line L788 states that every template is parameterized and contains no hardcoded values. However, the pseudocode includes fixed constants and built-in enumerations such as grade range [1,12] (L018, L068), behavior severity levels 1-5 (L505-L517), and explicit band/category lists like ["below_level", "at_level", "above_level"] (L169) and Bloom levels (L202), which directly contradict that blanket claim.

Natural-Language Policy Violations

Medium

• Confidence: 97% confidence
• Finding: The comment at L020 states 'All source and documentation files in English,' which is a natural-language policy constraint. Forcing a single language without user choice or a clearly documented compliance/regional reason matches the locale-policy violation criteria.

Natural-Language Policy Violations

Medium

• Confidence: 95% confidence
• Finding: The G-04 check actively scans files for possible non-English text and warns when such content is detected. This implements a language restriction across project files without presenting user choice or documenting a justified locale limitation.

Natural-Language Policy Violations

Low

• Confidence: 83% confidence
• Finding: Line L27 states that the project documentation is canonical English-language. This is a natural-language locale constraint, and the file does not indicate any user opt-in, alternative language support, or region-specific justification for imposing English as the canonical language.

Scope Creep

Low

• Category: Excessive Agency

Content

THERE IS NO WARRANTY FOR THE PROGRAM, TO THE EXTENT PERMITTED BY
APPLICABLE LAW.  EXCEPT WHEN OTHERWISE STATED IN WRITING THE COPYRIGHT
HOLDERS AND/OR OTHER PARTIES PROVIDE THE PROGRAM "AS IS" WITHOUT WARRANTY
OF ANY KIND, EITHER EXPRESSED OR IMPLIED, INCLUDING, BUT NOT LIMITED TO,
THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
PURPOSE.  THE ENTIRE RISK AS TO THE QUALITY AND PERFORMANCE OF THE PROGRAM
IS WITH YOU.  SHOULD THE PROGRAM PROVE DEFECTIVE, YOU ASSUME THE COST OF

• Confidence: 70% confidence
• Finding: Skill's behavior or capabilities extend beyond its stated purpose. Scope creep allows an agent to perform actions unrelated to its documented functionality, increasing the attack surface.

Scope Creep

Low

• Category: Excessive Agency

Content

THERE IS NO WARRANTY FOR THE PROGRAM, TO THE EXTENT PERMITTED BY
APPLICABLE LAW.  EXCEPT WHEN OTHERWISE STATED IN WRITING THE COPYRIGHT
HOLDERS AND/OR OTHER PARTIES PROVIDE THE PROGRAM "AS IS" WITHOUT WARRANTY
OF ANY KIND, EITHER EXPRESSED OR IMPLIED, INCLUDING, BUT NOT LIMITED TO,
THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
PURPOSE.  THE ENTIRE RISK AS TO THE QUALITY AND PERFORMANCE OF THE PROGRAM
IS WITH YOU.  SHOULD THE PROGRAM PROVE DEFECTIVE, YOU ASSUME THE COST OF

• Confidence: 70% confidence
• Finding: Skill's behavior or capabilities extend beyond its stated purpose. Scope creep allows an agent to perform actions unrelated to its documented functionality, increasing the attack surface.

Natural-Language Policy Violations

Low

• Confidence: 83% confidence
• Finding: This markdown file includes mixed-language subject labels such as "Chinese Language (语文)" and later jurisdiction references specific to China, but it does not state that the content is intentionally region-specific or offer a language/locale option. Under the policy, forcing a specific language or locale without user opt-in can be a natural-language policy violation.

Natural-Language Policy Violations

Low

• Confidence: 83% confidence
• Finding: The ELL test case specifies a learner 'proficient in Spanish' and expects a 'Bilingual glossary (English/Spanish)'. Because SQP-3 applies to natural-language locale constraints, this is a mild policy concern: the file prescribes a specific language output rather than framing language support as user-selected or configurable.

Static analysis

No suspicious patterns detected.