T06 · System Persistence
Error
- Location
README.md:19- Finding
Persistent daily execution through scheduled-task registration
- Content
View full analysis
- Remediation
View remediation
Security audit
feyman-coach
Security checks for vulnerabilities and agentic risk
Overview
This learning-coach skill is mostly coherent, but it asks users to enable persistent automation and unnecessary administrator-level setup, with some unsafe command and repository-write patterns.
Install only if you are comfortable with a Chinese-language skill that can scan your Markdown note vault and write review files. Avoid the administrator PowerShell setup, prefer manual or dry-run use first, use narrow vault paths, and do not enable scheduled tasks, GitHub Actions pushes, or third-party sync unless you have reviewed exactly what will run and where generated notes will be written.
Vulnerability Patterns
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
- System PersistenceInstalls backdoors, hooks, services, or scheduled tasks that survive the run
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Findings (4)
T05 · Unauthorized Access and Privilege Escalation
Error
- Location
README.md:19- Finding
Administrator privileges recommended for a per-user scheduled task
- Content
View full analysis
- Remediation
View remediation
T08 · Insecure Dependencies
Warning
- Location
README.md:9- Finding
Unpinned Python packages and mutable GitHub Actions dependencies
- Content
View full analysis
- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/daily_review.py:390- Finding
Notification text is interpolated into shell and PowerShell command strings
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Rogue AgentSelf-Modification, Session Persistence
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- Behavioral ASTexec() Call, eval() Call, Dynamic Import
Findings (22)
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md 在 `SKILL.md` 同级目录创建 `config.json`：
os.system() or os exec-family call
High
- Category
- Dangerous Code Execution
- Confidence
- 98% confidence
- Finding
The macOS notification path builds a shell command with untrusted data interpolated directly into an os.system() string. If the notification message ever contains quotes or shell/AppleScript metacharacters from future config, note content, or external inputs, it can break out of the intended command and execute arbitrary commands in the user's context.
- Content
python # macOS elif sys.platform == "darwin": os.system( f'osascript -e \'display notification "{message}" with title "费曼教练"\'' )
os.system() or os exec-family call
High
- Category
- Dangerous Code Execution
- Confidence
- 97% confidence
- Finding
The Linux notification path invokes notify-send through os.system with the message embedded in a shell command. Any attacker-controlled characters in the message can trigger shell injection, leading to arbitrary command execution when the daily review runs.
- Content
python # Linux else: os.system(f'notify-send "费曼教练" "{message}"') def run_daily_review(self): """执行每日回顾流程"""
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 85% confidence
- Finding
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
- Content
bash # 编辑 crontab crontab -e # 添加每日9点执行（根据你的实际路径调整） 0 9 * * * cd /path/to/your/note/project && python skills/feynman-coach/scripts/daily_review.py
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The GitHub Actions example performs unattended repository writes and pushes without clearly warning the user that it will modify remote repository state on a schedule. In a skill whose purpose is study coaching, that automation is higher risk because it can unexpectedly publish generated content, create noisy history, or commit unintended files if path assumptions change.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The README instructs users to set up a workflow that automatically commits and pushes generated files back to the repository, extending the skill from local coaching into autonomous remote state modification. While not overtly malicious, this creates an unnecessary write-and-publish capability that could propagate unwanted or sensitive generated content and is broader than the stated educational purpose.
- Content
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 85% confidence
- Finding
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
- Content
md **解决**： - Windows：检查任务计划程序中的任务状态 - macOS/Linux：检查 crontab 是否正确配置，运行 `crontab -l` 查看 ### 4. 通知没有显示
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 91% confidence
- Finding
The skill describes capabilities that imply reading notes, writing history/output files, and invoking shell commands for cron, PowerShell, GitHub Actions, and tool integrations, but it does not declare any explicit tool scope or permission boundary. This increases the risk that an agent executing the skill may use broader-than-expected file or shell access, especially in environments where undeclared capabilities are still available by default.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
The skill encourages configuration for automatic review, output generation, and persistent storage of history without clearly warning users that it may create files, modify notes, or schedule recurring system activity. Users may enable automation without understanding the data retention and system-side effects, which can lead to unintended writes, disclosure of sensitive note content, or persistence they did not expect.
- Content
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 85% confidence
- Finding
The cron example establishes persistent, unattended execution of the skill, which can repeatedly access notes and generate outputs after the initial setup. Persistence is not inherently malicious here, but unattended recurring execution increases risk because it can continue performing reads/writes or invoking follow-on actions without fresh user review each time.
- Content
macOS/Linux (cron)：
bash # 编辑 crontab crontab -e # 添加每日9点执行 0 9 * * * cd /path/to/your/project && opencode run /feynman daily-review
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The GitHub Actions workflow and external integrations with services like Anki and Notion are presented as normal usage patterns without a privacy notice that note contents or learning records may be transmitted to third-party systems. In a note-taking context, those materials can contain sensitive personal, academic, or workplace information, so silent or poorly explained external transfer materially increases confidentiality risk.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The example shows the skill searching and analyzing the user's note library to build a knowledge map and identify gaps, which expands the operational scope from coaching into broader repository inspection. Even if framed as a helpful feature, this can normalize access to more user data than expected and may lead to over-collection or unintended disclosure of note contents and metadata.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The example claims the skill saves recommendations into the user's notes and sets review reminders, introducing write actions and persistence beyond passive coaching. Undisclosed modification of user data or creation of reminders can surprise users, alter their knowledge base, and create integrity/privacy risks if done without explicit confirmation.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
Stating that the skill saves recommendations to notes and sets reminders without prior warning means the examples normalize state-changing behavior without informed consent. This is dangerous because users may invoke what appears to be a coaching function but trigger persistent changes to their files or workflow artifacts.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The docstring, CLI descriptions, prompts, and generated content are written entirely in Chinese, which effectively forces a specific language experience. The file does not offer user opt-in for language selection or explain that the skill is intentionally limited to a Chinese-language audience.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The skill is described as a Feynman-method knowledge coach for review, weak-point diagnosis, and study suggestions. While reminding the user is mentioned, this implementation uses PowerShell and direct os.system calls on macOS/Linux, introducing command-execution capability that is not inherently necessary for generating study reviews and exceeds the expected capability profile for a note-based coaching skill.
- Content
subprocess module call
Medium
- Category
- Dangerous Code Execution
- Confidence
- 70% confidence
- Finding
subprocess module calls execute external commands. Without careful input validation, this enables command injection.
- Content
python try: import subprocess subprocess.run( [ "powershell", "-Command",
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The script invokes platform shell commands via os.system to display notifications on macOS and Linux, which is a subprocess/shell execution path. Although the file generally describes its purpose, these specific shell executions occur without any inline warning, confirmation, or user-facing disclosure at the call site.
- Content
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 84% confidence
- Finding
The README encourages scheduled execution via Task Scheduler and cron, but does not clearly warn that the script will run recurrently and write files into the project automatically. This is a transparency and safe-deployment issue: users may enable persistence-like behavior without fully understanding the ongoing file modifications.
- Content
Intent-Code Divergence
Low
- Category
- Not specified by scanner
- Confidence
- 84% confidence
- Finding
The documentation says these features are 'to be implemented' but still provides concrete commands to execute export_anki.py and generate_report.py. The documented file structure only lists daily_review.py, so the examples contradict the stated implementation status and may mislead users about actual available functionality.
- Content
Intent-Code Divergence
Low
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The version history states in L424-L426 that auto-triggering, statistics, and Anki/Notion integrations are 'planned', while earlier sections describe these capabilities as available and give concrete usage/configuration instructions (for example L117-L147, L241-L314, and L401-L413). This is an active documentation contradiction about what the skill currently does or supports.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 84% confidence
- Finding
The file consistently presents user prompts, assistant behavior, and operational guidance in Chinese only. There is no indication that users can choose another language or that the language restriction is intentional and documented as a locale-specific skill.
- Content
Static analysis
No suspicious patterns detected.