Security audit

english-coach

Security checks for vulnerabilities and agentic risk

Overview

This is a coherent English-coaching skill that keeps local learning notes; users should be aware that practice text and corrections may be saved in the skill state files.

Install only if you are comfortable with the skill keeping local learning history in its state files. Do not provide private chats, credentials, confidential business text, or other sensitive material unless you are willing for excerpts, mistakes, and profile notes to be retained locally for future coaching.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (6)

Ssd 3

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The skill explicitly instructs the agent to persist user-provided material, original sentences, error records, and progress details into reusable state files and to surface parts of that content in later review output. This creates a data-handling vulnerability because personal or sensitive text supplied for coaching may be retained and reused beyond the immediate session without clear minimization, consent, or sensitivity filtering.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The instruction 纯英语口语 requires the assistant to respond only in English during conversation, limiting language choice by default. This is a natural-language policy concern because it imposes a specific language behavior unless the user actively asks otherwise, rather than offering a language or locale choice upfront.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The skill mandates automatic writes to local state files after each teaching session without requiring explicit user consent or presenting a user-facing notice that conversation content, errors, and learning history will be stored persistently. Because the stored data includes user-provided text, mistakes, and inferred profile updates, this creates a privacy and data-retention risk if sensitive content is entered during coaching.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The manifest description is written entirely in Chinese while presenting an English-learning coaching skill, which indicates a specific language/locale expectation for users. The policy requires either user language choice or a clearly documented justification for the locale constraint, neither of which appears here.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The entire file is written in Chinese and defines the skill's record format and automated behavior only in that language, with no indication that users may choose another language or locale. This is a natural-language policy concern because it imposes a specific language experience by default rather than documenting an opt-in or justified region-specific constraint.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The profile states that chatting in English is itself the practice and gives learning preferences framed entirely around English interaction and correction. This creates a natural-language locale/language policy constraint without offering the user a choice or documenting that the skill is intentionally limited to English-only use.
Content: No source excerpt is available for this finding.