Security audit

幼儿园识字与诗歌课程体系

Security checks for vulnerabilities and agentic risk

Overview

This is a local Chinese-literacy worksheet generator with expected file outputs, and the scanner concerns are usability or self-check caveats rather than evidence of harmful behavior.

Before installing, know that this skill creates local HTML and JSON worksheet files and may include a child's name if you provide one. Keep generated files in a normal workspace folder, and do not rely on its preflight report as a complete security audit. If it activates when you did not intend Chinese literacy worksheet generation, ask the agent to clarify or skip the skill.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (3)

Intent-Code Divergence

Medium

Confidence: 92% confidence
Finding: The docstring states that the preflight check enforces minimal-permission write-path restrictions, but the implementation never validates that file writes are constrained to approved --out/--json paths. This creates a false sense of security: maintainers may rely on the preflight report to approve a skill that still writes outside intended locations.

Vague Triggers

Medium

Confidence: 89% confidence
Finding: The README advertises broad trigger phrases such as '给孩子出一份识字练习' and similar generic requests, which can overlap with ordinary conversation and cause the skill to activate when the user did not explicitly request this specific capability. In an agent environment, over-broad invocation patterns can hijack routing, leading to unintended execution and inappropriate responses for unrelated prompts.

Natural-Language Policy Violations

Medium

Confidence: 74% confidence
Finding: The skill is described entirely around Chinese-language literacy output and includes trigger guidance that biases the agent toward Chinese responses, but the README does not state any locale gating, language negotiation, or fallback behavior. This can cause the system to answer in Chinese or generate Chinese-only materials even when the user's preferred language is different, creating usability and policy-routing issues rather than a direct code-execution risk.

Static analysis

No suspicious patterns detected.