Tech Tutor

• Outcome: Review
• Latest audit: Sep 16, 2026 · 10:08 AM UTC
• Version: 0.1.2

Overview

This is a coherent tech-tutoring skill, but it automatically saves and reuses learning records across user and project directories, so its privacy behavior needs review before installation.

Install only if you are comfortable with the skill saving learning-session content under ~/.tech-tutor/ and project .tech-tutor/ directories and reusing those records later. Avoid using it with confidential code or sensitive personal notes unless you control where records are written and can delete them. Prefer a pinned installer or reviewed commit instead of the mutable npx command.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: README.md:14

Finding

Unpinned Third-Party Installation Chain

Content

View full analysis

Vulnerability Details

File Location: README.md:14
Vulnerability Type: Supply-chain risk caused by mutable, unpinned dependencies
Risk Level: Medium

bash

npx skills add https://github.com/LeoGoat2004/tech-tutor

Technical Analysis

The documented installation command relies on two mutable third-party components:

1. npx resolves the skills package without an exact version.
2. The GitHub repository is referenced without an immutable commit hash or signed release tag.

Consequently, the code and Skill content retrieved when a user runs this command may differ from the content reviewed during this audit. Depending on npm behavior and the installer package, invoking npx may execute downloaded package code, including installer or lifecycle logic, on the user's system.

This is a supply-chain weakness rather than evidence that the currently audited repository contains malicious code.

Attack Path

1. An attacker compromises the npm account, package, or publishing pipeline associated with skills, or compromises the referenced GitHub repository.
2. The attacker publishes altered installer logic or malicious Skill content under the same mutable package or repository identifier.
3. A user follows the README and runs the documented command.
4. npx resolves and runs the altered package, or the installer retrieves altered content from the repository.
5. The malicious dependency executes with the permissions of the user running the command.

Impact Assessment

Successful exploitation could provide arbitrary code execution under the installing user's account if the resolved npm installer executes malicious code. This may allow access to files, credentials, environment variables, network resources, and other capabilities available to that user.

If only the installed Skill instructions are altered, the impact may instead include agent behavior manipulation, unauthorized tool use, or access to resources exposed to the agent. No priv ...[truncated 167 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin the npm installer to an exact reviewed version, rather than relying on current package resolution:

   bash

   npx --yes skills@<reviewed-exact-version> add ...
   

2. Replace the mutable repository URL with an immutable, reviewed commit hash or release artifact.
3. Publish and verify a SHA-256 checksum for the installed artifact.
4. Prefer signed release artifacts and document signature-verification steps.
5. Use npm provenance and lockfile or integrity metadata where supported.
6. Document the expected npm publisher and repository owner so users can detect namespace or ownership changes.
7. Review whether the installer runs lifecycle scripts; disable them where feasible or clearly disclose their behavior.
8. Apply the same hardened command to both README.md and README.zh-CN.md.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (17)

Anti-Refusal Statement

High

• Category: Anti-Refusal
• Confidence: 85% confidence

Finding

Skill instructs the agent to omit warnings, disclaimers, or ethical commentary. Stripping safety caveats hides risk from the user and is a common jailbreak preamble.

Content

Scanner excerpt · SKILL.md (reported line 321)May include surrounding context.

md

- Explain the *why* behind design decisions, not just the *what*
- Trace at least one complete path through the code, with inputs and outputs at each stage
- External docs explain tools, but the project explains itself
- The user discovers through questions — you guide, you don't lecture

---

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The README says users can invoke the skill with phrases like "I want to learn about [topic]" or "Help me understand this project," which overlap heavily with common everyday requests. The description does not provide boundaries, exclusion conditions, or a narrow activation context, so the trigger guidance is too broad for a markdown skill description.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The README describes automatic persistent learning records stored under user and project directories, but it does not present this as a prominent upfront warning before use. Users may disclose sensitive project details, personal notes, or internal code context without realizing the skill will retain that information on disk across sessions, creating privacy and data-retention risk.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence

Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence

Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The suggested invocation phrases are very broad, such as asking to learn a technology or understand a project, which can overlap with many normal user requests. In systems that auto-route based on natural-language triggers, this can cause accidental activation of the skill in unrelated contexts, unexpectedly exposing user content or causing the assistant to adopt this skill's behavior when not intended.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The README states that learning records are automatically saved under both a user-level directory and a project-local directory, including session history, insights, questions, and outputs, but it does not mention explicit consent, opt-in behavior, or privacy warnings. This creates a real risk of silently persisting sensitive user data, proprietary project details, or confidential repository context to disk where it may later be committed, shared, or accessed by other local users/processes.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The skill description is very broad and can match many ordinary learning requests, increasing the chance of unintended activation. Over-broad activation can cause the skill to run in contexts where its file-writing and cross-session behaviors were not expected by the user.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 35)May include surrounding context.

md

- **Reinforcement Learning**: RL algorithms, environments, applications
- **ROS**: Robot Operating System, robotics, simulation

> This is not an exhaustive list. Tech tutor can teach any CS/AI topic — it will just search for sources on the fly instead of using pre-configured ones. The user can also ask to create source configs for new domains.

## Two Learning Modes

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The skill says records are saved automatically after the session, but does not require an explicit user-facing consent step before writing session content to disk. This can lead to unexpected persistence of potentially sensitive learning content, project details, or code discussion artifacts.

Content

No source excerpt is available for this finding.

Ssd 3

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The skill is designed to capture and reuse user-provided session content across sessions and projects, including insights, questions, and project-specific learning. This creates a substantive data-retention and context-leakage risk, especially when project-level material is indexed globally and reused later.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The skill instructs default review and connected-learning checks across user-level and project-level records without a privacy notice or consent gate. That creates a risk of silently surfacing prior session content across contexts and projects, which may expose sensitive information or violate user expectations of compartmentalization.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 87% confidence

Finding

The manifest context says the skill is a Socratic learning companion for deep understanding, project deconstruction, and knowledge-building. This file instead defines a static catalog of reinforcement-learning links and source categories, which is a domain-specific resource list rather than tutoring behavior; that is a semantic mismatch between the skill's claimed purpose and the actual artifact present here.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The manifest describes a 'tech-tutor' skill intended to act as a Socratic learning companion for understanding CS and AI topics. This file instead contains a curated list of ROS, robotics, conference, paper, course, and community URLs, which is a domain-specific source registry rather than tutoring-oriented behavior or documentation for a tutor skill.

Content

No source excerpt is available for this finding.

Vague Triggers

Low

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The example trigger phrases are generic and likely to overlap with normal conversational requests, which makes accidental invocation more likely. Because this skill includes persistent storage features, accidental activation has more privacy and consent implications than a purely ephemeral skill.

Content

No source excerpt is available for this finding.

Vague Triggers

Low

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The description "Agent frameworks and harnesses authoritative sources" is a broad topical label rather than a specific trigger or activation condition. In a manifest file, this can make invocation criteria unclear because it does not define scope, constraints, or examples of when the skill should or should not activate.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 83% confidence

Finding

The phrase "DeepSeek Chinese tech blog" imposes a language/locale characterization in the manifest content without any note that users can choose alternative language sources or that the locale limitation is intentional for a region-specific purpose. This can conflict with language/locale policy expectations when no opt-in or justification is provided.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.