Security audit

化学实验探究教练

Security checks for vulnerabilities and agentic risk

Overview

This is a Chinese K12 chemistry lab coaching skill with disclosed safety, consent, profile, and reminder controls.

Install only for users who are comfortable with a Simplified Chinese, Mainland China K12 chemistry context. Enable profile memory, cross-skill sharing, or reminders only when the student or guardian wants progress tracking; otherwise the skill’s own instructions support current-session-only use.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (9)

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 85% confidence
Finding: This JSON schema contains natural-language descriptions entirely in Chinese and, more importantly, several enum values and field semantics that require Chinese-language content such as consent roles, age bands, mastery levels, and status labels. Because the file does not document that it is intentionally China/Chinese-specific or offer any locale choice, it imposes a language/locale constraint that can violate organizational language policy.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The schema allows subject_profile_writeback to learning-DNA related recipients, which expands the skill from answering chemistry lab questions into writing user profile data. Because profile mutation is privacy- and integrity-sensitive, granting it through a scoped educational skill creates unnecessary risk if the skill or orchestration layer is confused about authority boundaries.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The schema allows subject_profile_writeback to learning-DNA related recipients, which expands the skill from answering chemistry lab questions into writing user profile data. Because profile mutation is privacy- and integrity-sensitive, granting it through a scoped educational skill creates unnecessary risk if the skill or orchestration layer is confused about authority boundaries.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 86% confidence
Finding: The schema allows subject_profile_writeback to learning-DNA related recipients, which expands the skill from answering chemistry lab questions into writing user profile data. Because profile mutation is privacy- and integrity-sensitive, granting it through a scoped educational skill creates unnecessary risk if the skill or orchestration layer is confused about authority boundaries.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The natural-language note is written in Chinese and presents the protocol constraints as mandatory, while the schema contains no indication that language choice is optional or that the skill is intentionally region-specific. Under the policy, forcing a specific language without user opt-in or documented justification is a natural-language locale violation.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The schema's user-facing descriptions and notes are consistently Chinese-only, and no field provides a language/locale option or justification for a locale-restricted deployment. This creates a natural-language policy issue because the file effectively enforces one language without documenting user choice or a region-specific compliance reason.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The entire shared guidance is written as mandatory Chinese instructional content for downstream skills, and it includes prescribed user-facing phrases in Chinese such as the exact question at L14 and explanation at L34. There is no indication that users may choose another language or locale, which creates a natural-language policy concern if the skill is used in broader multilingual contexts.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 86% confidence
Finding: The document defines the repository-wide canonical vocabulary entirely in Chinese and states that all SKILL.md, references, and schemas must reference this file as the single source of truth. This effectively imposes a specific language/locale across dependent skills without offering user opt-in or documenting a region-specific justification in the file.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 82% confidence
Finding: L11 明确声明“本库按中国大陆的中文 K12 场景设计”，并指定示例与话术为简体中文、安全求助渠道默认中国大陆。这构成了默认语言/地区约束；虽然后文说明了跨地区部署前需做本地化，但本文件本身并未提供用户层面的语言/地区选择或显式 opt-in。
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.