Security audit

english-coach

Security checks for vulnerabilities and agentic risk

Overview

This is a local English-coaching skill whose persistent learning records are purpose-aligned, but users should know their practice text and progress may be saved in the skill state files.

Before installing, understand that this skill keeps local learning records in its state files, including chunks, original context, corrections, progress, and profile notes. Do not use highly sensitive personal chats or documents unless you are comfortable with that material being retained locally, and periodically review or clear the state files if you want a fresh start.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (6)

Missing User Warnings

Medium

Confidence: 96% confidence
Finding: The skill explicitly instructs persistent storage of learner data in local state files, including chunk history, mistakes, dates, and learner profile information, but does not require any user-facing notice or consent. This creates a privacy risk because users may provide personal conversations or texts without realizing their content will be retained across sessions.

Natural-Language Policy Violations

Medium

Confidence: 89% confidence
Finding: The skill mandates English-only replies during conversation and forbids Chinese explanations unless the user explicitly asks, which can override the user's preferred language or comprehension needs. This is risky because it may reduce transparency around corrections, storage behavior, or safety-relevant clarifications, especially for users who are less comfortable in English.

Missing User Warnings

Medium

Confidence: 90% confidence
Finding: The file explicitly states that practice records will be written automatically after the first exercise, but it does not mention any confirmation, notice, or user control. In an agent skill, silent state modification can surprise users, create unintended persistence of personal learning data, and weaken trust even if the stored content is not highly sensitive.

Missing User Warnings

Low

Confidence: 92% confidence
Finding: The file explicitly states that the coach will automatically append a learning record after the first session, which implies persistent data storage without any visible user notice or consent mechanism in this file. In a coaching skill, this is primarily a privacy and transparency issue rather than code execution risk, but it can still lead to unexpected retention of user learning content.

Ssd 3

Medium

Confidence: 97% confidence
Finding: The skill requires recording user-provided material, original sentences, errors, mastery status, and dates into persistent state files, creating a durable behavioral and content history. Even in an educational context, this is dangerous because sensitive personal text or conversation details may be retained and later reused without clear limits, minimization, or consent.

Ssd 3

Medium

Confidence: 95% confidence
Finding: The workflow directs the skill to load all prior state on each session and append detailed learning records every time, which increases accumulation and reuse of historical user data. This broad read/write pattern expands privacy exposure because any sensitive information previously stored becomes part of every future interaction context and may be unnecessarily surfaced or propagated.

Static analysis

No suspicious patterns detected.