Class Reminder

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 7:14 AM UTC
• Version: 1.0.0

Overview

This skill is a coherent Chinese-language course reminder tool that reads user-provided schedules and produces reminders, with only ordinary setup and file-output cautions.

Install this only if you are comfortable with a Chinese-language schedule reminder skill reading your course spreadsheet. Use a virtual environment for openpyxl, consider pinning the dependency, and review any cron or heartbeat setup yourself so reminders run only on the schedule and files you choose.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:75

Finding

Unpinned Third-Party Dependency Installation

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:75
Vulnerability Type: Unpinned package installation and insufficient supply-chain verification
Risk Level: Medium

Complete Code Snippet:

text

- 依赖 openpyxl，首次使用需 `pip install openpyxl`

The documentation instructs users to install openpyxl directly from the configured Python package index without specifying a reviewed version, a lock file, an approved repository, or cryptographic hashes.

Technical Analysis

Running pip install openpyxl resolves a mutable package version and its dependencies according to the user's current pip configuration. The resulting artifacts may therefore change after this Skill has been reviewed. Python package installation can process package metadata and build source distributions, potentially executing build-backend code under the privileges of the user performing the installation.

This is a supply-chain hardening weakness rather than evidence that openpyxl itself is malicious. Exploitation requires compromise or manipulation of a relevant package release, dependency, configured package index, package-resolution path, or similarly trusted distribution channel.

Attack Path

1. A user follows the installation instruction in SKILL.md.
2. The user runs pip install openpyxl without a pinned version or required artifact hashes.
3. pip resolves packages through the user's configured indexes and selects mutable artifacts.
4. An attacker who has compromised an applicable package release, dependency, index, or resolution configuration supplies a malicious artifact.
5. Package build or installation logic executes with the installing user's privileges, or malicious code executes when the installed module is imported.
6. The attacker gains code execution in the affected Python environment.

Impact Assessment

Successful exploitation could execute arbitrary code with the privileges of the user who installs or i ...[truncated 524 chars]

Remediation

View remediation

Remediation Suggestions

1. Declare dependencies in a dedicated requirements or project configuration file rather than an ad hoc installation command.
2. Pin openpyxl and all transitive dependencies to versions that have been reviewed and tested.
3. Generate a lock file containing cryptographic hashes for every permitted distribution artifact.
4. Install dependencies using hash enforcement, such as:

   bash

   python3 -m pip install --require-hashes -r requirements.txt
   

5. Prefer binary wheels from a trusted, explicitly configured package repository and avoid source builds where feasible.
6. Use an isolated virtual environment and do not install packages with elevated privileges.
7. Add automated dependency vulnerability and provenance scanning to the release process.
8. Periodically update pinned versions through a controlled review and testing workflow.

SkillSpector

Vulnerability Patterns

• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (7)

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 93% confidence

Finding

The skill instructs writing parsed course data to data/schedule.json in the workspace but does not declare any tool scope or permissions for file writing. This creates a mismatch between documented behavior and declared capabilities, weakening least-privilege controls and making unintended or unauthorized file modification harder to govern or review.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The package description is written entirely in Chinese and describes the assistant as a course reminder tool, but there is no indication that language choice is optional or that the skill is intentionally limited to a Chinese-speaking context. This creates a natural-language locale policy concern because the skill appears to assume a fixed language without user opt-in.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The script’s natural-language interface, including docstrings, error messages, and command-line help, is written in Chinese and does not provide any opt-in or alternative language selection. This can violate language/locale policy when a skill forces a specific language without giving the user a choice.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The file-level docstring is written entirely in Chinese and describes the skill behavior only in Chinese, which indicates a locale-specific language constraint without any visible user opt-in or alternative language handling. Under the policy rules, forcing a specific language without user choice is a natural-language policy violation unless clearly justified as region-specific.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The script's natural-language strings and stated purpose are entirely in Chinese, including the fallback message '查询失败', with no indication that users can choose another language or locale. This can violate language/locale policy when a skill forces one language by default without offering opt-in or documenting a justified regional constraint.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 83% confidence

Finding

This code performs a file write when the user supplies --output, but there is no confirmation prompt or explicit warning that running the command will create or overwrite a local file. For a code-file audit under SQP-2, file modification operations should have some form of user disclosure unless clearly warned elsewhere in the skill materials shown here.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The file description and all user-facing output are written in Chinese, and the script emits fixed Chinese strings for success, errors, and schedule summaries. This imposes a specific language/locale without any opt-in or documented justification, which matches the policy-violation criterion for language constraints.

Content

No source excerpt is available for this finding.