English-Learning

• Outcome: Review
• Latest audit: Sep 14, 2026 · 11:27 PM UTC
• Version: 1.0.0

Overview

The skill is a straightforward English-listening material fetcher, but it publishes a real-looking Supabase endpoint and anon key that users should review before installing.

Review this skill before installing because it exposes a specific Supabase backend URL and anon key. Use your own Supabase project credentials if appropriate, and the publisher should replace the example with placeholders, rotate the exposed key, and verify Row Level Security limits the anon role to intended read-only listening materials.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:47

Finding

Hard-Coded Supabase Anonymous API Credential

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 47-52
Vulnerability Type: Hard-coded credential in skill documentation
Risk Level: Medium

Vulnerable Code

text

SUPABASE_URL：你的项目 API 地址
示例：https://fhpyglovinmpqsnhqqay.supabase.co

SUPABASE_ANON_KEY：你的 anon key
示例：eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpc3MiOiJzdXBhYmFzZSIsInJlZiI6ImZocHlnbG92aW5tcHFzbmhxcWF5Iiwicm9sZSI6ImFub24iLCJpYXQiOjE3NjczODE1OTIsImV4cCI6MjA4Mjk1NzU5Mn0.q7go9R7Kcc-J4xobxmvQ_OQe6PfZ5VtKOzEdqQpPnYU

Technical Analysis

The documentation embeds a complete, project-specific Supabase anonymous JWT alongside its associated Supabase endpoint. Elsewhere in the file, users are instructed to send this value in both the apikey and Authorization: Bearer headers.

A Supabase anonymous key is intended for use by untrusted clients and is not equivalent to a service_role secret. Nevertheless, publishing a live key permits any party to authenticate as the associated project's anon role. The actual security boundary therefore depends entirely on the project's Row Level Security policies, table grants, storage policies, and exposed remote procedures. If any of those controls are missing or overly permissive, the key can facilitate unauthorized reading, insertion, modification, or deletion of backend data.

Attack Path

1. An attacker extracts the Supabase endpoint and JWT from SKILL.md.
2. The attacker submits REST, storage, authentication, or RPC requests to the identified Supabase project using the JWT as the API key and bearer token.
3. The attacker enumerates resources exposed to the anon role.
4. If Row Level Security, grants, or API policies are overly permissive, the attacker reads or modifies resources allowed by those policies.
5. The attacker can continue using the credential until it expires, is rotated, or the associated signing configuration changes.

Impact Assessment

The obtainable privileges are ...[truncated 434 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove the live project endpoint and JWT from the distributed documentation. Replace them with unmistakable placeholders such as https://YOUR_PROJECT.supabase.co and ${SUPABASE_ANON_KEY}.
2. Rotate or revoke the published credential according to Supabase's supported key-management procedure.
3. Require each deployment to provide its own endpoint and key through protected environment configuration rather than committed files.
4. Review every exposed table and enable Row Level Security wherever applicable.
5. Apply least-privilege policies to the anon role, allowing only the read operations required for active listening materials and their segments.
6. Revoke anonymous write, delete, storage, and RPC permissions unless they are explicitly required.
7. Validate that related tables cannot be accessed through unintended joins or embedded-resource queries.
8. Add secret scanning to version-control and release pipelines to prevent future publication of credentials.

SkillSpector

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• YARA Signatures: Malware Match, Webshell Match, Cryptominer Match
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (4)

YARA rule 'agent_skill_mcp_tool_poisoning_metadata': MCP/tool metadata poisoning indicators in tool schemas or skill manifests [agent_skills]

High

• Category: YARA Match
• Confidence: 81% confidence

Finding

The YARA hit is likely driven by the embedded JWT-like Supabase anon key rather than actual tool-metadata poisoning instructions. While this does not appear to be prompt/tool poisoning, embedding credential-like material in the skill manifest/documentation is still dangerous because it exposes backend access details and can aid abuse or reconnaissance.

Content

Scanner excerpt · SKILL.md (reported line 3)May include surrounding context.

md

---
name: 英语听力训练
description: 提供小学、专四、专八英语听力材料，支持获取材料列表和详细段落。
version: 1.0.0
author: 你的名字
env:
  - SUPABASE_URL
  - SUPABASE_ANON_KEY
---

# 英语听力训练助手

当用户需要听力训练时，按以下步骤操作。

## 1. 获取训练类别
目前支持三种类别：
- 小学 → 代码 `primary`
- 专四 → 代码 `tem4`
- 专八 → 代码 `tem8`

用户可以说：“小学英语听力”、“专四材料”、“给我专八练习”等。

## 2. 根据类别获取材料列表

调用 API（将 `{catego

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The instruction "当用户需要听力训练时" is ambiguous because it does not specify explicit invocation boundaries or exclusion conditions. This can cause unintended activation for general discussion about listening practice rather than a clear request to use this skill.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The skill documentation includes a real-looking Supabase anon key example, which appears to be an actual credential rather than a clearly fake placeholder. Even if it is an anon key, publishing live service credentials enables unauthorized use of the backend, data scraping, quota abuse, and reconnaissance against the linked Supabase project.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 76% confidence

Finding

The skill name and description are entirely scoped to English listening training categories such as primary, TEM4, and TEM8, but the file does not state whether the interaction language or locale is user-selectable. Under the policy, language or locale constraints should be offered as a choice or clearly justified.

Content

No source excerpt is available for this finding.