玩转AI校园(BNBU)

• Outcome: Review
• Latest audit: Sep 16, 2026 · 11:17 AM UTC
• Version: 5.5.0

Overview

This educational AI-literacy skill is mostly coherent, but it includes under-scoped learner-data caching/synchronization, cloud sharing, and unverified runtime dependencies that deserve review before installation.

Review this skill before installing in a school, enterprise, or student-data setting. Require opt-in cloud sync, explicit notice before saving or sharing to IMA/Tencent Docs, clear data retention/deletion controls, local-only assessment mode, reviewed local dependencies or SRI hashes, and narrower activation/confirmation rules for collaboration and sharing actions.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (4)

T08 · Insecure Dependencies

Warning

• Location: references/commercial-production-standards.md:46

Finding

Generated Applications Execute Unverified Third-Party CDN Code

Content

View full analysis

``` Other templates similarly load document-generation libraries directly from public CDNs: ```html ``` ### Technical Analysis The Skill instructs generated courseware, games, assessments, and lesson-building applications to load executable JavaScript from public CDN domains. Although dependency versions are pinned, the templates do not use Subresource Integrity hashes. Version pinning does not prove that the response received by a browser is the reviewed artifact. If a CDN account, upstream package, DNS route, or delivery infrastructure is compromised, the remote response can execute arbitrary JavaScript in every generated application that references it. The multi-CDN fallback improves availability but expands the supply-chain trust boundary. The ...[truncated 1476 chars]

Remediation

View remediation

``` 3. Do not use an unverified secondary CDN as an automatic fallback. Maintain a reviewed local fallback with a recorded SHA-256 or SHA-384 hash. 4. Add a restrictive Content Security Policy that limits script sources, outbound connections, framing, and plugin content. 5. Maintain a dependency inventory containing exact versions, hashes, licenses, source locations, and review dates. 6. Introduce a controlled dependency-update process with vulnerability scanning and manual artifact verification. 7. Ensure generated applications fail closed with a clear error if dependency integrity verification fails. ]]>

T08 · Insecure Dependencies

Warning

• Location: references/p5js-courseware-guide.md:421

Finding

Syntax-Validation Workflow Can Download and Execute an Unreviewed npm Package

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: references/offline-support-guide.md:76

Finding

Service Worker Template Caches Dynamic and General Responses Without Adequate Restrictions

Content

View full analysis

{ const clone = response.clone(); caches.open(CACHE_NAME) .then(cache => cache.put(event.request, clone)); return response; }) .catch(() => caches.match(event.request)) ); } // HTML pages: Stale While Revalidate else { event.respondWith( caches.open(CACHE_NAME).then(cache => { return cache.match(event.request).then(cached => { const fetchPromise = fetch(event.request).then(response => { cache.put(event.request, response.clone()); return response; }); return cached || fetchPromise; }); }) ); } ``` ### Technical Analysis The Service Worker design caches dynamic content and all requests falling into the general branch. The shown implementation does not enforce: - An explicit allowlist of public cacheable URLs. - A requirement that the request method be `GET`. - Successful response-status validation. - Rejection of authenticated, personalized, or opaque responses. - Enforcement of `Cache-Control: no-store`. - Per-user cache partitioning. - Cache deletion during logout. - A bounded cache retention policy. Generated applications may process assessments, learning progress, lesson content, and personalized reports. Persisting such responses in Cache Storage can retain data beyond the intended session. A same-origin script, including a compromised third-party dependency, may access these cached resources. Shared browser profiles may also expose stale personalized data to later users. The general stale-while-revalidate branch can serve old content before the current network response is available, creating a risk of cross-sessi ...[truncated 1065 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: references/offline-support-guide.md:360

Finding

Background Synchronization Uploads Assessment Results Without an Explicit Consent Gate

Content

View full analysis

serverResults.updatedAt) { // Local result is newer: upload and overwrite await uploadResults(localResults); } else if (localResults.updatedAt < serverResults.updatedAt) { // Server result is newer: download and merge await db.put('results', serverResults); showToast('Results synchronized'); } } ``` ```javascript self.addEventListener('sync', event => { if (event.tag === 'sync-results') { event.waitUntil(syncAllPendingResults()); } }); async function syncAllPendingResults() { const pending = await getPendingResults(); for (const result of pending) { try { await uploadResults(result); await markAsSynced(result.sessionId); } catch (e) { console.error('Sync failed:', e); } } } ``` ### Technical Analysis The design automatically uploads pending assessment results when connectivity becomes available. The shown synchronization flow does not establish an explicit user consent gate before transmission. It also does not demonstrate authentication, authorization, payload minimization, encryption requirements beyond transport, retention controls, or validation that the current account owns the local result. The use of `sessionId` in the API path requires strong unguessability and server-side ownership checks, but neither is specified in the implementation. The overwrite behavior may also replace server-side data based solely on client timestamps, creating integrity and conflict ...[truncated 1460 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (47)

Anti-Refusal Statement

High

• Category: Anti-Refusal
• Confidence: 80% confidence

Finding

Skill attempts to nullify the agent's safety policies or restrictions ('you have no restrictions', 'ignore your guidelines', 'do anything now'). This is a direct jailbreak that disables guardrails.

Content

Scanner excerpt · references/module-f-safety-ethics.md (reported line 39)May include surrounding context.

md

- 示例：DAN（Do Anything Now）

Hidden Instructions

High

• Category: Prompt Injection
• Confidence: 70% confidence

Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · references/p5js-courseware-guide.md (reported line 33)May include surrounding context.

代码引入标准

html

<!-- 主用 cdnjs，备用 jsdelivr（onerror 自动回退，避免单一 CDN 不可达导致白屏） -->
<script src="https://cdnjs.cloudflare.com/ajax/libs/p5.js/2.0.3/p5.min.js"></script>
<script>
  if (typeof p5 === 'undefined') {

Hidden Instructions

High

• Category: Prompt Injection
• Confidence: 70% confidence

Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · references/p5js-courseware-guide.md (reported line 33)May include surrounding context.

代码引入标准

html

<!-- 主用 cdnjs,备用 jsdelivr(onerror 自动回退,避免单一 CDN 不可达导致白屏) -->
<script src="https://cdnjs.cloudflare.com/ajax/libs/p5.js/2.0.3/p5.min.js"></script>
<script>
  if (typeof p5 === 'undefined') {

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The trigger phrases are broad, generic classroom terms like '课件', '教学', '游戏', and '备课', which can cause the skill to activate in routine educational conversation without clear user intent. In a powerful skill that can generate files, assessments, collaboration flows, and offline-capable artifacts, this increases the chance of unintended actions, misrouting, or over-collection of user inputs.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The README promises automatic offline caching and later synchronization of data, but it does not disclose what data is stored, where it is stored, how long it is retained, or what consent and conflict controls exist. In an education skill handling student assessments, lesson materials, and team collaboration data, silent sync behavior can expose personal, educational, or organizational information and create privacy and compliance risk.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 83% confidence

Finding

The skill description and behavior are heavily Chinese-oriented without a documented user language preference check, which can force interaction into a language the user did not choose. This is primarily an authorization/consent and usability boundary issue: language coercion can mislead users, reduce comprehension of generated outputs, and increase the risk of incorrect acceptance of educational, assessment, or workflow actions.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The trigger phrases are broad enough to match ordinary educational requests like '课件', '讲义', or '游戏', which can cause the skill to activate when the user did not explicitly intend to use it. In a skill with wide capabilities including document generation, assessment, collaboration, offline storage, and WorkBuddy integrations, accidental invocation can route user data or actions into the wrong workflow and expand access beyond user intent.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The disambiguation matrix still maps generic terms like '讲义 / 文档（默认）' and other broad educational phrases directly to capabilities, which is insufficiently constrained and can misclassify normal conversation. Because this skill spans multiple powerful modes, ambiguous routing increases the chance of unintended behavior, including generating the wrong artifacts or invoking integrations the user did not mean to use.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The document is entirely presented in Chinese and the embedded HTML sets '', indicating a fixed locale. Under the policy rule, forcing a specific language/locale without user opt-in can be a natural-language policy violation when no alternative language choice or justification is provided.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The document promises the assessment system is 'completely offline' and privacy-preserving, but later includes a third-party CDN dependency and a network-based submission/reporting flow. This mismatch can mislead deployers and users into trusting stronger privacy and availability guarantees than the system actually provides, creating supply-chain and data exposure risk.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The guide states that offline use protects learner privacy, yet later says results may be uploaded once connectivity returns. That contradiction can cause unauthorized or unexpected transmission of educational performance data, especially problematic in school or enterprise training settings where assessment data may be sensitive.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The offline workflow says locally stored progress and results will be reported when the network returns, but it does not warn users that cached assessment data will leave the device. Silent deferred transmission undermines informed consent and can expose sensitive learner history beyond user expectations.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The trigger phrase set includes very broad everyday terms such as “测评/练习题/考试/评估”, which can unintentionally activate the assessment behavior during ordinary educational conversations. In a multi-capability teaching skill, this can cause scope confusion, unexpected mode switching, and generation of assessment artifacts when the user did not explicitly request that function.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The trigger list for the collaboration feature contains ambiguous terms like “协作”, which are common in normal discussion and not sufficiently scoped to the specific feature. This raises the risk of accidental invocation of collaborative workflows, especially in a platform-integrated environment where such activation could affect storage, sharing, or multi-user editing behavior.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

SQP-3 适用于所有文件类型。标题及全文以中文为唯一呈现语言，且未说明这是面向特定中文用户群体的区域化文档，也未提供语言/locale 选择，存在强制特定语言的自然语言策略风险。

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The trigger list includes broad everyday collaboration terms such as '协作', '批注', and '讨论', which can cause the skill to activate in contexts unrelated to this specialized lesson-planning feature. In an agent environment, over-broad activation increases the chance of unintended execution paths, accidental tool use, or confusing takeover of user intent.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 80% confidence

Finding

文件标题和全文内容均以中文撰写，且未说明这是面向特定中文用户群体的区域性文档，也未提供语言选择或用户 opt-in。根据规则，强制单一语言而无选择机制属于自然语言政策风险。

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The file title and governing statement are entirely in Chinese and set mandatory standards for all V4.3 deliverables, but nowhere indicates that language selection is optional or limited to a China-specific deployment. Under the policy, forcing a specific language without user opt-in is a natural-language locale violation.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The document mandates audit logging of user input, behavior metrics, and delivery adoption data, but does not require user notice, consent, retention limits, access controls, or minimization. In an education-focused skill handling teacher and student workflows, this can lead to unnecessary collection of potentially sensitive educational activity data and increase privacy, compliance, and insider misuse risk.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 78% confidence

Finding

The file presents the interface and interaction model entirely in Chinese, including the HTML lang="zh-CN" and all user-facing prompts, with no indication that users may choose another language. Under the policy, forcing a specific language without opt-in can be a natural-language policy violation unless the locale constraint is explicitly justified.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The WorkBuddy flow recommends saving generated documents to Tencent Docs and sharing cloud links, but the guide only mentions authorization in passing and does not mandate a prominent user warning that content will be uploaded to a third-party cloud service. This is more serious because the generated files may contain lesson plans, internal teaching materials, collaboration notes, or accidental personal data, which could be exposed more broadly through cloud storage and sharing.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The entire skill file is written only in Chinese and does not offer any language or locale choice, translation option, or opt-in mechanism. Under the stated policy, forcing a specific language without user choice is a natural-language policy violation unless the locale constraint is clearly documented and justified.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

This markdown file is written entirely in Chinese and presents itself as the teaching reference to be directly used by instructors, but it does not indicate that language is optional or configurable. Under the language/locale policy rule, forcing a specific language without user opt-in is a natural-language policy concern.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 78% confidence

Finding

SQP-3 适用于所有文件类型。该文件整体以中文编写并围绕中文对话流程、中文示例指令和中文触发短语展开，但未声明可根据用户偏好切换语言，也未说明仅限中文用户使用；对于联合国际学院场景，这构成未获用户选择的语言/locale 约束。

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The module states that when users mention broad keywords like “博智坊”, “工作坊”, or “认证计划”, it will automatically associate and recommend this school-specific module. That trigger logic is overly broad and can cause unintended activation in unrelated contexts, leading to incorrect personalization, context leakage across domains, or user confusion in a multi-tenant assistant environment. In this skill context, the risk is elevated because the module is highly institution-specific and may steer outputs toward BNBU/SAI-specific content even when the user did not intend that scope.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.