ai-literacy-expert-v5

• Outcome: Review
• Latest audit: Oct 2, 2026 · 10:59 AM UTC
• Version: 7.0.0

Overview

This is a broad teaching-automation skill with real scheduling and cloud-document integration, but those capabilities are disclosed, purpose-aligned, and guarded by confirmation and authorization instructions.

Install this only if you want a teaching skill that can help set up scheduled WorkBuddy automations and write course outputs to IMA, Tencent Docs, calendars, reminders, or shares. Before enabling any OPS flow, review the preview, cron time, destination systems, sharing scope, and how to pause or delete the task; also verify the included registry state against your actual scheduler.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (112)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence

Finding

The declared description presents a very large, multifunction teaching automation platform with scheduler, workflow routing, state persistence, assessment, recommendation, content generation, and WorkBuddy integration. The actual code chunk does only one narrow function: automated UI/control verification of HTML/p5.js artifacts using Playwright, producing audit reports and a gating result. While this testing harness loosely relates to the declared VERIFY/Playwright closure mentioned in the description, it does not implement the skill’s primary claimed capabilities such as scheduling, cross-session memory, workflow orchestration, teaching-content generation, assessment, or recommendation. Therefore the description materially overstates and misrepresents what this code chunk actually does.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The supplied code does not implement the declared teaching, courseware-generation, assessment, recommendation, collaboration, or cron-scheduler workflow capabilities. Its primary purpose is repository QA: validating that an existing selfcheck script can detect intentionally injected faults. While this may support maintainability or verifiability of the broader skill, the actual behavior of this code chunk is materially different from the declared end-user functionality. Therefore this chunk is mismatched with the declared description.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The description presents the skill as an operational teaching-content and automation engine. The code chunk does not implement those user-facing capabilities; instead, it performs package health/compliance validation for the skill repository. While the self-check script references L4 scheduler assets and workflow documentation, it only verifies their presence and consistency rather than executing scheduling, automation, assessment, content generation, or distribution behavior. This is a material description-behavior mismatch because the primary purpose of the code is internal QA/static validation, not the declared teaching workflow functionality.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The code chunk does not implement the described end-user skill behavior. Instead, it performs offline/static QA of documentation artifacts for scheduler contracts. While this relates loosely to the declared L4 scheduling theme, it does not actually schedule tasks, run automation pipelines, manage persistent state, or provide the teaching/content-generation capabilities emphasized in the description. Its real purpose is validation of markdown/template content and command examples, so the description materially overstates and misrepresents the behavior of this code chunk.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence

Finding

The code chunk is narrowly focused on validating scheduler semantics in a simulated environment, not delivering the full end-user functionality promised by the description. It does align with a subset of the declared scheduler claims—stateful execution, idempotency, audit ledger behavior, failure degradation, and cross-session persistence—but only as a local simulator/test harness rather than a real unattended cron automation layer. The primary described purpose is a comprehensive teaching workflow/productivity skill spanning content generation, assessment, recommendations, collaboration, and operational automation. The actual code does not implement those major capabilities and instead serves as internal verification logic for one subsystem. Because the declared description presents many substantive capabilities absent from the code and implies real scheduling/integration behavior not present here, this is a material description-behavior mismatch.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The description promises a large end-user skill centered on AI-literacy teaching workflows and multiple content/assessment/collaboration capabilities, plus an L4 scheduler that actually registers and runs cron jobs with persistent state and auditing. The actual code chunk does none of that directly. It is a test script for scheduler-api.sh, focused on safe verification of read-only operations and validation/error-handling behavior. While the script is tangentially related to the declared scheduler theme, its primary purpose is narrow QA of scheduler API validation and zero-side-effect auditing. It does not implement the advertised educational generation, assessment, recommendation, collaboration, WorkBuddy distribution, or workflow orchestration features. Therefore the declared description materially overstates and misrepresents what this code chunk actually does.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The code chunk does not implement the skill's advertised primary capabilities. It is narrowly focused on artifact regression testing: invoking a Node/Playwright harness on predefined HTML files, validating expected outcomes, and emitting console/JSON summaries. While the description mentions Playwright-based control testing as one supporting feature, this script alone is not a workflow engine, scheduler, content generator, adaptive assessor, or WorkBuddy-integrated automation layer. Therefore the supplied code materially under-delivers relative to the declared purpose and represents a description-behavior mismatch for this chunk.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence

Finding

The description promises a comprehensive, stateful, schedulable teaching-workflow platform with many automation, orchestration, integration, and educational capabilities. This code does not implement that platform behavior. Instead, it only generates a small set of static OPS-5 demo/test artifacts and one negative-test page. While the generated artifacts do align with a small subset of the declared claims—namely p5.js interactive courseware and a companion game for AI-literacy content—the primary behavior of this code chunk is much narrower and lacks the advertised scheduler, persistent workflow state, automation framework, assessment/recommendation systems, WorkBuddy integration, and broad multi-flow orchestration. Therefore the description materially overstates what this supplied code chunk actually does.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The description claims an operational teaching workflow/scheduling skill with broad educational generation and automation capabilities. The code chunk does not implement those runtime capabilities. Instead, it audits files in the skill package to verify that documentation and assets claim the right version, coverage, registry fields, and packaging structure. It performs static consistency/completeness checks and emits a test report. While this supports the declared system as a QA artifact, the chunk’s actual primary behavior is repository validation rather than running or providing the described teaching workflows, scheduler, assessments, or content generation. Therefore the description does not accurately represent this code chunk.

Content

No source excerpt is available for this finding.

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 31)May include surrounding context.

md

- **控件实测自动化闭环**：新增 `assets/playwright-control-test-harness.js`——把 §11 门控从「人工逐项点」升级为「Playwright 自动枚举+触发+捕获报错+复测」，生成→实测→修复(≤3)→复测。

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 87)May include surrounding context.

md

- **控件实测自动化闭环**：新增 `assets/playwright-control-test-harness.js`——把 §11 门控从「人工逐项点」升级为「Playwright 自动枚举+触发+捕获报错+复测」，生成→实测→修复(≤3)→复测。

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 144)May include surrounding context.

md

- **控件实测自动化闭环**：新增 `assets/playwright-control-test-harness.js`——把 §11 门控从「人工逐项点」升级为「Playwright 自动枚举+触发+捕获报错+复测」，生成→实测→修复(≤3)→复测。

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 274)May include surrounding context.

md

- **控件实测自动化闭环**：新增 `assets/playwright-control-test-harness.js`——把 §11 门控从「人工逐项点」升级为「Playwright 自动枚举+触发+捕获报错+复测」，生成→实测→修复(≤3)→复测。

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 282)May include surrounding context.

md

- **控件实测自动化闭环**：新增 `assets/playwright-control-test-harness.js`——把 §11 门控从「人工逐项点」升级为「Playwright 自动枚举+触发+捕获报错+复测」，生成→实测→修复(≤3)→复测。

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 295)May include surrounding context.

md

- **控件实测自动化闭环**：新增 `assets/playwright-control-test-harness.js`——把 §11 门控从「人工逐项点」升级为「Playwright 自动枚举+触发+捕获报错+复测」，生成→实测→修复(≤3)→复测。

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 296)May include surrounding context.

md

- **控件实测自动化闭环**：新增 `assets/playwright-control-test-harness.js`——把 §11 门控从「人工逐项点」升级为「Playwright 自动枚举+触发+捕获报错+复测」，生成→实测→修复(≤3)→复测。

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 374)May include surrounding context.

md

- **控件实测自动化闭环**：新增 `assets/playwright-control-test-harness.js`——把 §11 门控从「人工逐项点」升级为「Playwright 自动枚举+触发+捕获报错+复测」，生成→实测→修复(≤3)→复测。

Anti-Refusal Statement

High

• Category: Anti-Refusal
• Confidence: 80% confidence

Finding

Skill attempts to nullify the agent's safety policies or restrictions ('you have no restrictions', 'ignore your guidelines', 'do anything now'). This is a direct jailbreak that disables guardrails.

Content

Scanner excerpt · references/module-f-safety-ethics.md (reported line 39)May include surrounding context.

md

- 示例：DAN（Do Anything Now）

Hidden Instructions

High

• Category: Prompt Injection
• Confidence: 70% confidence

Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · references/p5js-courseware-guide.md (reported line 33)May include surrounding context.

代码引入标准

html

<!-- 主用 cdnjs，备用 jsdelivr（onerror 自动回退，避免单一 CDN 不可达导致白屏） -->
<script src="https://cdnjs.cloudflare.com/ajax/libs/p5.js/2.0.3/p5.min.js"></script>
<script>
  if (typeof p5 === 'undefined') {

Hidden Instructions

High

• Category: Prompt Injection
• Confidence: 70% confidence

Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · references/p5js-courseware-guide.md (reported line 33)May include surrounding context.

代码引入标准

html

<!-- 主用 cdnjs,备用 jsdelivr(onerror 自动回退,避免单一 CDN 不可达导致白屏) -->
<script src="https://cdnjs.cloudflare.com/ajax/libs/p5.js/2.0.3/p5.min.js"></script>
<script>
  if (typeof p5 === 'undefined') {

Env Variable Harvesting

High

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Code enumerates, copies, or searches environment variables for secrets. Bulk environment access can collect credentials unrelated to the skill's stated purpose.

Content

Scanner excerpt · tests/mutation-test.py (reported line 56)May include surrounding context.

python

def run_selfcheck():
    env = dict(os.environ, V7_TEST_OUT="/tmp/mut-out")
    p = subprocess.run([sys.executable, SELF, "--quiet"],
                       capture_output=True, text=True, env=env, cwd=WORK)
    return p.returncode, p.stdout + p.stderr

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The README advertises automatic delivery into external systems and device-side targets such as knowledge bases, calendars, reminders, and sharing endpoints, but does not pair those capabilities with prominent privacy, consent, and impact warnings. In a skill explicitly designed for automation, this omission can lead users to enable workflows that write data or trigger actions across connected systems without fully understanding scope, persistence, or disclosure risk.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The README strongly promotes unattended scheduled execution, real cron registration, cross-session state, idempotent reruns, and autonomous automation-session behavior, but does not present an equally prominent warning about the risks of autonomous actions. In context, this is more dangerous than a normal content-generation skill because it is explicitly built to persist state and act later without a user present, increasing the chance of unintended writes, disclosure, spammy distribution, or hard-to-notice misconfiguration at scale.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 95% confidence

Finding

The skill advertises and instructs use of powerful capabilities including shell, file read/write, environment access, Playwright execution, and scheduler/task management, but it does not declare an explicit tool scope or permission boundary. In a skill designed for unattended cron-driven execution and cross-session persistence, missing least-privilege declarations materially increases the risk of overbroad access, unintended file mutation, scheduler abuse, or execution in contexts the user did not expect.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The claim that the skill can run automatically 'without the user speaking' makes activation and consent boundaries less clear, especially because the same document also describes cron registration, unattended execution, persistent state, and external integrations. Ambiguous autonomous activation increases the chance of unauthorized or surprising behavior, particularly if users do not clearly understand when the system will act on its own.

Content

No source excerpt is available for this finding.

Static analysis

Detected: suspicious.dangerous_exec

Shell command execution detected (child_process).

Critical

• Code: suspicious.dangerous_exec
• Location: assets/playwright-control-test-harness.js:29