feyman-coach

• Outcome: Review
• Latest audit: Sep 11, 2026 · 4:44 AM UTC
• Version: 1.0.0

Overview

This learning-coach skill is mostly coherent, but it asks users to enable persistent automation and unnecessary administrator-level setup, with some unsafe command and repository-write patterns.

Install only if you are comfortable with a Chinese-language skill that can scan your Markdown note vault and write review files. Avoid the administrator PowerShell setup, prefer manual or dry-run use first, use narrow vault paths, and do not enable scheduled tasks, GitHub Actions pushes, or third-party sync unless you have reviewed exactly what will run and where generated notes will be written.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• System Persistence: Installs backdoors, hooks, services, or scheduled tasks that survive the run
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads

Findings (4)

T06 · System Persistence

Error

• Location: README.md:19
• Finding: Persistent daily execution through scheduled-task registration<![CDATA[ ## Vulnerability Details **File Location**: `README.md:19-39` **Additional Locations**: `SKILL.md:248-263`, `examples/usage_examples.md:103-107` **Vulnerability Type**: Scheduled-task persistence **Risk Level**: High ### Vulnerable Code ```powershell # Create a daily task that executes at 9:00 AM $action = New-ScheduledTaskAction -Execute "python" -Argument "$PWD\skills\feynman-coach\scripts\daily_review.py" $trigger = New-ScheduledTaskTrigger -Daily -At 9am Register-ScheduledTask -Action $action -Trigger $trigger -TaskName "FeynmanDailyReview" -Description "Daily Feynman learning review" # Verify that the task was created Get-ScheduledTask -TaskName "FeynmanDailyReview" ``` ```bash # Edit the user crontab crontab -e # Execute every day at 9:00 AM 0 9 * * * cd /path/to/your/note/project && python skills/feynman-coach/scripts/daily_review.py ``` The same persistence mechanism is repeated in `SKILL.md` and the usage examples. ### Technical Analysis The documentation instructs users to register a Windows scheduled task or cron entry that survives the current Skill invocation and executes the review program every day. This is an explicit persistence mechanism. Scheduling is relevant to the declared optional automatic-review feature and is not installed silently by the Python script. Nevertheless, it is not required for manual or interactive review functionality. Once configured, the script repeatedly executes with the permissions of the account owning the scheduled task and can read Markdown files from the configured vault and write review files without additional confirmation. The task invokes a generic interpreter or command by name and relies on a working-directory-dependent script path. This increases exposure to executable search-path manipulation, script replacement, or project-directory compromise. ### Attack Path 1. The user follows the documentation and registers the scheduled task or cron entry. 2. The task persists across sessio ...[truncated 1120 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Make scheduled execution explicitly opt-in and present manual execution as the default. 2. Do not describe persistent scheduling as required for the core Skill. 3. Show the exact resolved interpreter and script paths before registration. 4. Use absolute, validated paths rather than `python`, `opencode`, `$PWD`, or a relative script path. 5. Register the task only for the current unprivileged user. 6. Restrict write permissions on the script, project directory, and interpreter. 7. Provide removal instructions, such as: - Windows: `Unregister-ScheduledTask -TaskName "FeynmanDailyReview"` - macOS/Linux: remove the corresponding entry with `crontab -e` 8. Document which directories are read and modified during every scheduled run. 9. Consider a reminder generated by the note application itself instead of a system-level persistent task. ]]>

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: README.md:19
• Finding: Administrator privileges recommended for a per-user scheduled task<![CDATA[ ## Vulnerability Details **File Location**: `README.md:19-25` **Vulnerability Type**: Excessive privilege recommendation **Risk Level**: High ### Vulnerable Code ```powershell # Run PowerShell as administrator # Create a daily task that executes at 9:00 AM $action = New-ScheduledTaskAction -Execute "python" -Argument "$PWD\skills\feynman-coach\scripts\daily_review.py" $trigger = New-ScheduledTaskTrigger -Daily -At 9am Register-ScheduledTask -Action $action -Trigger $trigger -TaskName "FeynmanDailyReview" -Description "Daily Feynman learning review" ``` ### Technical Analysis The README tells the user to run PowerShell as an administrator before registering a daily task. The declared functionality only needs to read the user's note vault, create review Markdown files, append to an existing daily note, and display a user notification. Those operations normally require only the current user's permissions. Consequently, administrator-level task registration exceeds the minimum privilege necessary for the Skill. The task also references `python` by name and constructs the script path from the current directory, rather than recording validated absolute paths. If a writable executable, script, or directory is later substituted, scheduled execution could occur in a more privileged context than the task requires. The task registration command does not explicitly request the highest run level, so the exact runtime token depends on Windows Task Scheduler defaults and the resulting task configuration. The unsafe issue is the unnecessary use of an elevated registration context and the possibility of creating or managing the task with excessive authority. ### Attack Path 1. The user opens an administrator PowerShell session as instructed. 2. The task is registered while the user is operating in an elevated context. 3. The configured action references `python` and a working-directory-derived script path. 4. An attacker with write access to a searched exec ...[truncated 872 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Remove the instruction to run PowerShell as an administrator. 2. Register the task as the current user with the lowest available run level. 3. Explicitly configure the task not to run with highest privileges. 4. Resolve and record the full path to `python.exe`. 5. Resolve and validate the full path to `daily_review.py`. 6. Ensure only the intended user and trusted administrators can modify the interpreter, script, and parent directories. 7. Display the final task principal, run level, executable path, arguments, and working directory for user confirmation. 8. Recommend manual execution if a least-privilege task cannot be created. ]]>

T08 · Insecure Dependencies

Warning

• Location: README.md:9
• Finding: Unpinned Python packages and mutable GitHub Actions dependencies<![CDATA[ ## Vulnerability Details **File Location**: `README.md:9-12` **Additional Locations**: `README.md:59-63`, `SKILL.md:289` **Vulnerability Type**: Unpinned third-party dependencies **Risk Level**: Medium ### Vulnerable Code ```bash pip install tomli pip install win10toast ``` ```yaml steps: - uses: actions/checkout@v3 - name: Set up Python uses: actions/setup-python@v4 with: python-version: '3.10' ``` `SKILL.md` additionally references a mutable major-version action tag: ```yaml - uses: actions/checkout@v2 ``` ### Technical Analysis The installation instructions fetch the latest versions of `tomli` and `win10toast` without specifying reviewed versions or package hashes. The GitHub Actions examples likewise reference mutable major-version tags rather than immutable commit SHAs. This does not establish that any named dependency is malicious. The security issue is that the effective third-party code can change after this project has been reviewed. A compromised package publisher, package index, release, action repository, or mutable action tag could cause different code to execute during a later installation or CI run. The GitHub Actions workflow is particularly sensitive because it receives repository contents and a token and subsequently performs a `git push`. ### Attack Path 1. A user runs an unpinned `pip install` command, or GitHub Actions resolves a mutable action tag. 2. The package registry or action repository returns a newer or compromised artifact. 3. Third-party installation hooks, imported package code, or action code executes in the local or CI environment. 4. In CI, malicious action code can read repository contents and any credentials available to the job. 5. Depending on workflow token permissions, it may modify repository contents or abuse the later push operation. ### Impact Assessment For local installation, impact is limited by the account running `pip`, but can include access to that user's files, n ...[truncated 456 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Pin Python dependencies to reviewed versions in a lock file. 2. Use hashes, for example through `pip install --require-hashes -r requirements.txt`. 3. Prefer Python 3.11 or later's built-in `tomllib` where available, reducing the dependency surface. 4. Document that `win10toast` is optional and avoid installing it unless notifications are required. 5. Pin every GitHub Action to a reviewed immutable commit SHA. 6. Use automated dependency update tooling to review proposed version changes. 7. Define minimal workflow permissions, such as read-only contents unless a push is strictly required. 8. If repository writes are required, grant only the narrow permission needed and use protected branches or pull requests instead of an automatic direct push. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/daily_review.py:390
• Finding: Notification text is interpolated into shell and PowerShell command strings<![CDATA[ ## Vulnerability Details **File Location**: `scripts/daily_review.py:390-425` **Vulnerability Type**: Potential command injection **Risk Level**: Medium ### Vulnerable Code ```python def send_notification(self, message: str): """Send a notification reminder.""" if sys.platform == "win32": try: from win10toast import ToastNotifier toaster = ToastNotifier() toaster.show_toast("Feynman Coach", message, duration=10) except ImportError: try: import subprocess subprocess.run( [ "powershell", "-Command", f"Add-Type -AssemblyName System.Windows.Forms; " f"[System.Windows.Forms.MessageBox]::Show('{message}', 'Feynman Coach')", ], check=False, ) except Exception: print(f"[Notification] {message}") elif sys.platform == "darwin": os.system( f'osascript -e \'display notification "{message}" with title "Feynman Coach"\'' ) else: os.system(f'notify-send "Feynman Coach" "{message}"') ``` The source uses localized notification text, but the security-relevant structure above is unchanged: `message` is inserted directly into command-language strings. ### Technical Analysis On macOS and Linux, `os.system()` passes the constructed string through the operating-system shell. A message containing shell metacharacters or quote characters can terminate the expected argument and append another command. The Windows fallback avoids `shell=True`, but it passes dynamically generated source code to PowerShell through `-Command`. A single quote in `message` can terminate the PowerShell string literal and inject additional PowerShell expressions. In the audited call path, `run_daily_review()` supplies a fixed, program-generated no ...[truncated 1872 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Replace `os.system()` with argument-array subprocess calls using `shell=False`. 2. On Linux, invoke the notification tool as: ```python subprocess.run( ["notify-send", "Feynman Coach", message], check=False, shell=False, ) ``` 3. On macOS, avoid embedding the message in AppleScript source. Pass it as an argument to a fixed script or use a notification API. 4. On Windows, avoid constructing PowerShell source from `message`. Prefer a native Python notification library or pass data through a mechanism that does not interpret it as PowerShell code. 5. If PowerShell cannot be avoided, apply correct PowerShell literal escaping and validate the input length and allowed characters. 6. Keep notification content separate from executable command text. 7. Add unit tests containing quotes, semicolons, command substitutions, newlines, and platform-specific metacharacters. 8. Continue ensuring that note titles, note bodies, configuration values, and remote content cannot directly reach command-construction sinks. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Behavioral AST: exec() Call, eval() Call, Dynamic Import

Findings (22)

Ae1

High

• Category: analysis-evasion

Content

在 `SKILL.md` 同级目录创建 `config.json`：

• Confidence: 100% confidence
• Finding: Referenced artifact was not completely inspected

os.system() or os exec-family call

High

• Category: Dangerous Code Execution

Content

# macOS
        elif sys.platform == "darwin":
            os.system(
                f'osascript -e \'display notification "{message}" with title "费曼教练"\''
            )

• Confidence: 98% confidence
• Finding: The macOS notification path builds a shell command with untrusted data interpolated directly into an os.system() string. If the notification message ever contains quotes or shell/AppleScript metacharacters from future config, note content, or external inputs, it can break out of the intended command and execute arbitrary commands in the user's context.

os.system() or os exec-family call

High

• Category: Dangerous Code Execution

Content

# Linux
        else:
            os.system(f'notify-send "费曼教练" "{message}"')

    def run_daily_review(self):
        """执行每日回顾流程"""

• Confidence: 97% confidence
• Finding: The Linux notification path invokes notify-send through os.system with the message embedded in a shell command. Any attacker-controlled characters in the message can trigger shell injection, leading to arbitrary command execution when the daily review runs.

Session Persistence

Medium

• Category: Rogue Agent

Content

```bash
# 编辑 crontab
crontab -e

# 添加每日9点执行（根据你的实际路径调整）
0 9 * * * cd /path/to/your/note/project && python skills/feynman-coach/scripts/daily_review.py

• Confidence: 85% confidence
• Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The GitHub Actions example performs unattended repository writes and pushes without clearly warning the user that it will modify remote repository state on a schedule. In a skill whose purpose is study coaching, that automation is higher risk because it can unexpectedly publish generated content, create noisy history, or commit unintended files if path assumptions change.

Context-Inappropriate Capability

Medium

• Confidence: 91% confidence
• Finding: The README instructs users to set up a workflow that automatically commits and pushes generated files back to the repository, extending the skill from local coaching into autonomous remote state modification. While not overtly malicious, this creates an unnecessary write-and-publish capability that could propagate unwanted or sensitive generated content and is broader than the stated educational purpose.

Session Persistence

Medium

• Category: Rogue Agent

Content

**解决**：
- Windows：检查任务计划程序中的任务状态
- macOS/Linux：检查 crontab 是否正确配置，运行 `crontab -l` 查看

### 4. 通知没有显示

• Confidence: 85% confidence
• Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 91% confidence
• Finding: The skill describes capabilities that imply reading notes, writing history/output files, and invoking shell commands for cron, PowerShell, GitHub Actions, and tool integrations, but it does not declare any explicit tool scope or permission boundary. This increases the risk that an agent executing the skill may use broader-than-expected file or shell access, especially in environments where undeclared capabilities are still available by default.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: The skill encourages configuration for automatic review, output generation, and persistent storage of history without clearly warning users that it may create files, modify notes, or schedule recurring system activity. Users may enable automation without understanding the data retention and system-side effects, which can lead to unintended writes, disclosure of sensitive note content, or persistence they did not expect.

Session Persistence

Medium

• Category: Rogue Agent

Content

**macOS/Linux (cron)**：
```bash
# 编辑 crontab
crontab -e

# 添加每日9点执行
0 9 * * * cd /path/to/your/project && opencode run /feynman daily-review

• Confidence: 85% confidence
• Finding: The cron example establishes persistent, unattended execution of the skill, which can repeatedly access notes and generate outputs after the initial setup. Persistence is not inherently malicious here, but unattended recurring execution increases risk because it can continue performing reads/writes or invoking follow-on actions without fresh user review each time.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The GitHub Actions workflow and external integrations with services like Anki and Notion are presented as normal usage patterns without a privacy notice that note contents or learning records may be transmitted to third-party systems. In a note-taking context, those materials can contain sensitive personal, academic, or workplace information, so silent or poorly explained external transfer materially increases confidentiality risk.

Description-Behavior Mismatch

Medium

• Confidence: 91% confidence
• Finding: The example shows the skill searching and analyzing the user's note library to build a knowledge map and identify gaps, which expands the operational scope from coaching into broader repository inspection. Even if framed as a helpful feature, this can normalize access to more user data than expected and may lead to over-collection or unintended disclosure of note contents and metadata.

Description-Behavior Mismatch

Medium

• Confidence: 95% confidence
• Finding: The example claims the skill saves recommendations into the user's notes and sets review reminders, introducing write actions and persistence beyond passive coaching. Undisclosed modification of user data or creation of reminders can surprise users, alter their knowledge base, and create integrity/privacy risks if done without explicit confirmation.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: Stating that the skill saves recommendations to notes and sets reminders without prior warning means the examples normalize state-changing behavior without informed consent. This is dangerous because users may invoke what appears to be a coaching function but trigger persistent changes to their files or workflow artifacts.

Natural-Language Policy Violations

Medium

• Confidence: 95% confidence
• Finding: The docstring, CLI descriptions, prompts, and generated content are written entirely in Chinese, which effectively forces a specific language experience. The file does not offer user opt-in for language selection or explain that the skill is intentionally limited to a Chinese-language audience.

Context-Inappropriate Capability

Medium

• Confidence: 95% confidence
• Finding: The skill is described as a Feynman-method knowledge coach for review, weak-point diagnosis, and study suggestions. While reminding the user is mentioned, this implementation uses PowerShell and direct os.system calls on macOS/Linux, introducing command-execution capability that is not inherently necessary for generating study reviews and exceeds the expected capability profile for a note-based coaching skill.

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

try:
                    import subprocess

                    subprocess.run(
                        [
                            "powershell",
                            "-Command",

• Confidence: 70% confidence
• Finding: subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The script invokes platform shell commands via os.system to display notifications on macOS and Linux, which is a subprocess/shell execution path. Although the file generally describes its purpose, these specific shell executions occur without any inline warning, confirmation, or user-facing disclosure at the call site.

Missing User Warnings

Low

• Confidence: 84% confidence
• Finding: The README encourages scheduled execution via Task Scheduler and cron, but does not clearly warn that the script will run recurrently and write files into the project automatically. This is a transparency and safe-deployment issue: users may enable persistence-like behavior without fully understanding the ongoing file modifications.

Intent-Code Divergence

Low

• Confidence: 84% confidence
• Finding: The documentation says these features are 'to be implemented' but still provides concrete commands to execute export_anki.py and generate_report.py. The documented file structure only lists daily_review.py, so the examples contradict the stated implementation status and may mislead users about actual available functionality.

Intent-Code Divergence

Low

• Confidence: 93% confidence
• Finding: The version history states in L424-L426 that auto-triggering, statistics, and Anki/Notion integrations are 'planned', while earlier sections describe these capabilities as available and give concrete usage/configuration instructions (for example L117-L147, L241-L314, and L401-L413). This is an active documentation contradiction about what the skill currently does or supports.

Natural-Language Policy Violations

Low

• Confidence: 84% confidence
• Finding: The file consistently presents user prompts, assistant behavior, and operational guidance in Chinese only. There is no indication that users can choose another language or that the language restriction is intentional and documented as a locale-specific skill.

Static analysis

No suspicious patterns detected.