Security audit

math-grade2-spring

Security checks for vulnerabilities and agentic risk

Overview

This is a Chinese grade-school math tutoring skill with no executable code, network access, or hidden install behavior, though parents should note its progress-tracking language.

Reasonable to install for Chinese second-grade math support. Before relying on progress or wrong-answer tracking for a child, confirm whether the host agent stores that information, how it can be deleted, and whether a parent or guardian controls it; also verify the intended textbook edition.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (8)

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The README advertises automatic learning-progress tracking, study duration statistics, accuracy rates, and wrong-answer recording without disclosing whether student data is stored, for how long, or who can access it. Because this skill is aimed at children, undisclosed retention or collection of educational activity data raises meaningful privacy and compliance risk even if no obvious exfiltration is shown in this file.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The trigger description is broad enough to capture many generic education or homework-help requests, which can cause the skill to activate outside its narrow intended scope. Over-broad routing increases the chance of unintended data collection or inappropriate use of specialized behavior when a general assistant response would be safer.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The skill advertises progress tracking, study-time statistics, accuracy rates, and error logging for children, but provides no notice about what learner data is stored, for how long, who can access it, or whether parental consent is required. Because the skill is aimed at primary-school students, omission of child-data handling safeguards materially raises privacy and compliance risk.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 81% confidence
Finding: A language/locale policy issue applies when a skill effectively forces a specific language without user choice. This README presents all instructions, examples, and usage guidance only in Chinese, with no indication that other languages are supported or that Chinese is an explicit opt-in constraint.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Low

Category: Not specified by scanner
Confidence: 98% confidence
Finding: README在L010写明“北京师范大学出版社 2025 年 12 月第一版（新课标）”，但后文L245又说明“本技能基于北师大版2024版教材”。这是文档内部对技能所依据教材版本的直接冲突，会误导用户对技能实际适用范围的理解。
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 91% confidence
Finding: This markdown file is entirely presented in Chinese, starting from the title, and does not indicate that the user can choose another language or that the content is intentionally limited to a Chinese-language audience. Under the policy rule for language or locale constraints, forcing a specific language without user opt-in is a natural-language policy concern.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 92% confidence
Finding: This markdown file presents all instructions and answers exclusively in Chinese, which can amount to a language/locale policy issue when no user opt-in or region-specific scope is stated. The file does not indicate that the content is intentionally limited to Chinese-speaking users or tied to a documented locale requirement.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 92% confidence
Finding: This markdown file contains user-facing instructional content exclusively in Chinese from the title onward. Under the policy rule for natural-language violations, forcing a specific language without user opt-in can be a locale policy issue when no alternative or justification is provided.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.