Security audit

Learning System Skill

Security checks for vulnerabilities and agentic risk

Overview

This is mostly a coherent learning-notes skill, but its weekly review can gather private workspace activity and send a summary through Feishu without clear approval or destination controls.

Review or remove the Feishu sending step before installing, especially if memory logs, notes, PRs, or code changes may contain private work. Avoid --quick and automated weekly cron use unless you have confirmed exactly what will be read, what files may be changed, and where any summary will be sent.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (5)

Description-Behavior Mismatch

Medium

Confidence: 95% confidence
Finding: The weekly review mode includes sending a summary via Feishu, but this external transmission is not disclosed in the manifest. That means a user could trigger a learning review expecting local note updates while the skill exfiltrates potentially sensitive work summaries, research history, or project details to an external messaging platform.

Context-Inappropriate Capability

Medium

Confidence: 88% confidence
Finding: Sending summaries over Feishu is not necessary for the core purpose of organizing and updating a personal learning system, so it expands the skill's data exposure surface beyond its stated function. Because the skill processes memory logs, PRs, and weekly activity, the transmitted summary could contain sensitive internal engineering or research information.

Vague Triggers

Medium

Confidence: 86% confidence
Finding: The trigger phrases are broad and common, including everyday expressions like '总结一下', 'recap', and 'what did I learn', which increases the chance of accidental invocation. In this skill, accidental activation is more dangerous because the skill can read local files, modify notes, and potentially send summaries externally.

Missing User Warnings

Medium

Confidence: 94% confidence
Finding: The skill supports automatic file modifications and, in review mode, external message sending, yet the description does not clearly warn users about these side effects. Combined with the '--quick' option and automatic mode selection, this can cause silent note changes or data sharing without informed user consent.

Vague Triggers

Medium

Confidence: 92% confidence
Finding: The trigger list includes very generic phrases such as "learning" and "study," which are likely to match ordinary user requests outside the intended scope of this skill. This can cause the skill to activate unexpectedly, leading to prompt hijacking of unrelated conversations, degraded routing accuracy, and unintended access to context that should have been handled by a different skill.

Static analysis

No suspicious patterns detected.