Security audit

玩转AI校园(BNBU)

Security checks across malware telemetry and agentic risk

Overview

This education workflow skill is mostly purpose-aligned, but it needs review because it can automate cloud saves, sharing, reminders, calendar/memo writes, and scheduled workflows with incomplete user-control boundaries.

Install only if you are comfortable with a teaching skill that may generate materials and connect them to WorkBuddy cloud and device workflows. Before using delivery, scheduling, sharing, sync, or reports, require the agent to show the exact destination, data being saved or shared, timing, recipients, and how to cancel or delete it; treat the included demo confirmations as unreliable unless the host confirms the action actually happened.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (28)

Description-Behavior Mismatch

Medium

Confidence: 94% confidence
Finding: The page claims it has written to calendar, alarms, and IMA/WorkBuddy storage, but the implementation only changes on-page text and stores a localStorage flag. This is deceptive behavior that can mislead users into believing operational tasks or reminders were actually scheduled, causing missed actions or unsafe reliance on nonexistent automation.

Context-Inappropriate Capability

Medium

Confidence: 94% confidence
Finding: The page executes JavaScript from third-party CDNs at runtime, which creates a supply-chain risk: if the CDN, dependency, or network path is compromised, arbitrary code will run in the page's origin. For a simple educational mini-game, this capability is not strictly necessary and is somewhat more concerning in this skill because the broader package advertises automated workflows and delivery integrations, increasing the value of any compromise.

Context-Inappropriate Capability

Low

Confidence: 93% confidence
Finding: The page loads executable JavaScript from third-party CDNs (cdnjs with a jsDelivr fallback), which introduces a supply-chain trust dependency outside the local game code. If either CDN response is compromised, blocked, or altered, arbitrary script could execute in the page context.

Description-Behavior Mismatch

Medium

Confidence: 93% confidence
Finding: The UI claims that clicking the button writes the study plan to a memo/calendar and demonstrates a device-side WorkBuddy capability, but the implementation only stores data in browser localStorage and appends a success message. This is a security-relevant integrity issue because users may make decisions based on a false belief that reminders or records were actually persisted externally, leading to missed deadlines or misplaced trust in automation.

Intent-Code Divergence

Medium

Confidence: 91% confidence
Finding: The page text and success feedback imply real persistence to memo/calendar systems, while the code performs only a local cache write. In a workflow/education automation skill that advertises WorkBuddy-native delivery and time-triggered operations, this mismatch increases the risk of deceptive operation, reducing user ability to verify whether important planning data was actually saved.

Intent-Code Divergence

Medium

Confidence: 95% confidence
Finding: The document claims the assessment system is 'completely offline' while later requiring network submission/report retrieval and embedding a remote CDN script. This creates a misleading trust boundary: users may believe no network access or third-party dependency exists when data can still leave the device or code can be fetched remotely.

Intent-Code Divergence

Medium

Confidence: 94% confidence
Finding: The conflict-resolution example contains unreachable branches because it returns immediately from the timestamp-based winner selection, so the documented merge and manual-resolution paths never run. In a collaboration system this can silently discard edits or fail to surface true conflicts, causing integrity and availability issues in shared educational content and making users overtrust the stated safeguards.

Intent-Code Divergence

Medium

Confidence: 93% confidence
Finding: The sync example treats fetch(`/api/results/${sessionId}`) as if it returned parsed result data, but fetch actually returns a Response object. Subsequent logic compares properties like updatedAt and writes the Response directly into IndexedDB, which can break synchronization, cause stale or incorrect conflict resolution, and potentially overwrite valid local data with unusable objects.

Missing User Warnings

Medium

Confidence: 94% confidence
Finding: The README advertises automatic delivery to device-side alarms, calendars, memos, sharing targets, and external services such as IMA/Tencent Docs without clearly stating that user data and personal device state may be modified. In an agent context, this can normalize silent writes or broad side effects, increasing the risk of unintended disclosure, spammy automation, or unauthorized changes to a user's accounts and device artifacts.

Missing User Warnings

Medium

Confidence: 92% confidence
Finding: The offline section promises automatic synchronization after reconnect without disclosing what offline data is uploaded, where it is sent, or whether users can review it first. That creates privacy and integrity risk because locally cached educational content, assessments, notes, or collaboration artifacts could be transmitted unexpectedly once connectivity returns.

Vague Triggers

Medium

Confidence: 87% confidence
Finding: The skill instructs the platform to prefer this skill over generic chat for a very broad set of common education-related intents. That can cause over-invocation, routing users into a high-capability workflow engine when they expected a simple conversation, increasing the chance of unintended automation or data handling.

Vague Triggers

Medium

Confidence: 89% confidence
Finding: Many trigger phrases such as '课件', '讲义', '文档', '学习建议', and similar educational terms are generic and likely to appear in normal conversation. Broad trigger overlap can activate the skill unexpectedly, exposing users to automated generation, storage, sharing, or workflow side effects they did not intend.

Vague Triggers

Low

Confidence: 78% confidence
Finding: The fallback logic defaults ambiguous requests into one of several capabilities instead of failing closed. In a skill that advertises automated delivery, testing, and time-triggered operations, permissive fallback increases the chance of unintentional capability activation.

Missing User Warnings

High

Confidence: 94% confidence
Finding: The skill describes automatic cloud delivery, saving to knowledge bases and Tencent Docs, sharing, and device-side actions, but does not require explicit user-facing consent or warn about privacy and account impact. This is dangerous because educational materials, assessments, student data, or internal notes could be persisted or shared to external systems without sufficiently informed approval.

Missing User Warnings

High

Confidence: 95% confidence
Finding: The workflow engine promises autonomous distribution, reporting, learning-feedback loops, and time-triggered operations, yet the spec does not define clear user consent gates, approval checkpoints, or safeguards for recurring actions. In context, this is more dangerous because the skill targets teaching and assessment workflows, which may involve sensitive educational records and repeated automated actions across accounts or devices.

Missing User Warnings

Medium

Confidence: 87% confidence
Finding: The user-facing text says the system will write to calendar, alarms, and IMA without any confirmation or permission flow. In a workflow engine positioned as automation software, such claims normalize silent modification of user data and can erode consent boundaries, especially if later wired to real integrations.

Missing User Warnings

Low

Confidence: 72% confidence
Finding: The page writes the user's generated study plan to localStorage without clearly informing the user beforehand that the data will persist in the browser. While the stored content is low sensitivity in this example, silent persistence can still surprise users on shared devices and establishes a weak privacy pattern that becomes more concerning if future versions store personalized or educational data.

Vague Triggers

Medium

Confidence: 85% confidence
Finding: The use case '开启「工作流自动化」：一句话跑完整链路，或按时间自动推进运营流' indicates the skill may be invoked by a very broad, underspecified request and then autonomously execute a multi-stage pipeline. In a skill that can generate content, run verification, distribute to external systems, and schedule time-driven actions, weak invocation constraints increase the risk of unintended high-impact actions from ambiguous or overly generic prompts.

Missing User Warnings

Medium

Confidence: 94% confidence
Finding: The manifest explicitly describes writing generated materials to Tencent Docs and writing plans into memo/calendar systems, but does not mention user-facing warnings, confirmation prompts, or permission boundaries. Because these are external state-changing actions that can create, overwrite, or distribute data, silent or automatic execution could cause unauthorized disclosure, spam, accidental edits, or persistence of incorrect content.

Missing User Warnings

Medium

Confidence: 91% confidence
Finding: The guide describes persisting answers, results, and question caches in IndexedDB and later uploading scores, but provides no notice, consent flow, retention policy, or data handling boundaries. For an education-focused assessment system, this can expose student performance history and answer data without informed user awareness, especially on shared devices.

Vague Triggers

Medium

Confidence: 89% confidence
Finding: The trigger list for the assessment capability includes broad, common terms such as ‘测评’, ‘练习题’, ‘测验’, and ‘评估’. In a skill-selection or routing system, these generic phrases can cause unintended activation during ordinary educational conversation, leading the workflow engine to invoke the wrong capability or auto-orchestrated pipeline without clear user intent.

Vague Triggers

Medium

Confidence: 87% confidence
Finding: The recommendation feature is triggered by ambiguous phrases like ‘帮我设计课程’ and ‘课程规划’, which are common requests that may overlap with generic tutoring, brainstorming, or lesson discussion. In this skill’s broader context—where downstream automation may assemble content, assessments, collaboration artifacts, and delivery outputs—ambiguous activation increases the risk of unintended workflow execution and incorrect tool use.

Missing User Warnings

Low

Confidence: 91% confidence
Finding: The document describes time-triggered automation that can write to external systems, create reminders, and share content, but the opening section does not present a prominent consolidated warning about user consent, scope of actions, and data-handling risks. In this skill’s context, the danger is elevated because the workflow is explicitly designed for recurring autonomous operation across calendars, alarms, IMA, and Tencent Docs, which increases the chance of unintended writes, oversharing, or user surprise if guardrails are missed or only mentioned later.

Missing User Warnings

Medium

Confidence: 91% confidence
Finding: The logging guidance captures detailed user input, generated output metadata, errors, and user adoption/trigger metrics, but it does not require user notice, minimization, retention limits, or consent/authorization checks. In an education-focused skill that may process student and teacher workflows, this creates privacy and compliance risk and can lead to collection of sensitive instructional or personal data beyond user expectations.

Vague Triggers

Medium

Confidence: 89% confidence
Finding: The module defines broad trigger words such as '博智坊', '工作坊', and '认证计划' and says to 'automatically associate this module', which can cause the skill to activate during ordinary educational discussion rather than only when the user explicitly wants BNBU/SAI-specific behavior. In an agent-routing context, overly broad auto-association can misroute requests, override more appropriate skills, and expose institution-specific prompts or workflows when they were not requested.

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

Detected: suspicious.dangerous_exec

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: assets/playwright-control-test-harness.js:29