Security audit

学习娃

Security checks for vulnerabilities and agentic risk

Overview

This skill coherently generates local Chinese math-teaching HTML pages and does not show hidden data access, persistence, or exfiltration behavior.

Installers should understand this is a Chinese-focused local HTML generator. Use it in a normal workspace, review or choose the output path, and avoid placing generated files over important existing documents. Custom SVGs should remain static and inline as the skill instructs.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (10)

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 270)May include surrounding context.
md
| `SKILL.md` | 主规范（本文件）：判断、硬约束、自检 |

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 276)May include surrounding context.
md
| `templates/learnwa-template.html` | 通用 H5 模板（含 CSS/SVG/交互/朗读） |

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 279)May include surrounding context.
md
| `templates/learnwa-template.html` | 通用 H5 模板（含 CSS/SVG/交互/朗读） |

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 89% confidence
Finding: The skill instructs the agent to read and write local files and invoke a generator script, but it does not declare any explicit tool scope such as allowed-tools or permissions. That creates a least-privilege gap: an agent runtime may grant broader filesystem capabilities than the skill actually needs, increasing the chance of unintended file access or overwrites if the skill is invoked with adversarial input or misused by the model.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The title and all instructional content are written in Chinese, and the example user inputs and expected phrasing are consistently Chinese-only. There is no indication that users may choose another language or that the skill is intentionally limited to a Chinese-speaking context for compliance or regional reasons.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The file title and all user-facing examples and instructions are exclusively in Chinese, framing the skill format as Chinese-only usage. There is no indication that users may choose another language or that the Chinese-only constraint is justified as a region-specific requirement.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: This markdown file is written entirely in Chinese and repeatedly specifies Chinese labels and UI text, including font stacks like 'PingFang SC' and 'Microsoft YaHei'. Under the policy rule for language/locale, this appears to force a specific language/locale rather than offering a user-selectable option or documenting a justified regional constraint.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: This code embeds user-facing guidance, errors, prompts, and examples entirely in Chinese, and the top-level docstring explicitly says repair suggestions are provided in Chinese. Across the CLI flow, there is no option to choose another language or locale, so the skill imposes a specific language by default rather than offering user choice.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The code sets u.lang='zh-CN' for all spoken output, forcing a specific language/locale. This is a natural-language policy concern because the file provides no user opt-in or configurable language selection for speech output.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 93% confidence
Finding: This markdown file is natural-language instructional content, and it consistently uses Chinese for headings, instructions, and parent prompts. Under the language/locale policy rule, forcing a specific language without giving the user a choice or documenting a justified locale constraint is a policy concern.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.