Security audit

语文写作教练

Security checks for vulnerabilities and agentic risk

Overview

This is a disclosed Chinese writing-coach skill that uses consent-gated student writing profiles and contains no executable or hidden install behavior.

Before installing, users should understand that this skill is designed for Chinese K12 writing practice and may use an optional long-term writing profile only after consent. It includes controls to view, correct, delete, pause, export, and restrict sharing of that profile.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (8)

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The skill metadata description contains broad trigger phrases such as '帮我写作文', '我的作文怎么改', and especially '帮我打开思路', which can plausibly appear in ordinary conversation and may cause the orchestrator to activate this skill when the user did not intend a writing-coach workflow. Unintended activation can lead to incorrect routing, unnecessary collection or use of student writing-profile data, and degraded handling of other tasks that should have gone to a different skill.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 87% confidence
Finding: The title and module reference indicate the skill is designed around Chinese-language debate and writing coaching, but the file does not state that this locale is optional or limited to a region-specific context. Under the policy, forcing a specific language without user opt-in can be a natural-language policy violation.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The title and skill identity are explicitly Chinese-language specific, and the document presents the workflow as mandatory behavior for the skill without offering any user choice of language or locale. Under the policy, forcing a specific language is a natural-language policy issue unless the locale constraint is clearly documented and justified.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: This markdown file is entirely written as a Chinese-only specification and repeatedly frames the skill behavior around Chinese-language analysis without any opt-in or alternative language handling. Under the policy rule, forcing a specific language or locale without user choice is a natural-language policy concern unless the constraint is explicitly documented and justified as region-specific.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: This schema hard-codes the skill to a Chinese-language subject branch and describes student profiling fields specifically for Chinese writing, with no natural-language indication that the user can choose another language or that the locale restriction is optional. Under the policy, forced language/locale behavior without user opt-in or explicit justified regional scope is a natural-language policy concern.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The schema title, scope note, and description are written entirely in Chinese and describe the protocol as specific to '小智伴学', but the file does not state that this skill or protocol is intentionally limited to Chinese-speaking users or a China-specific deployment. Under the policy, forcing a specific language without explicit opt-in or justification is a natural-language locale violation.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The document states the library is designed for '中国大陆的中文 K12 场景' and defaults examples, wording, and crisis-help channels to Mainland China. This is a natural-language locale policy constraint that applies broadly, and the file does not present an end-user choice or opt-in within the default behavior.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The skill instructions, examples, and user-facing invocations are entirely in Chinese, and there is no statement that the user must opt into Chinese or that the skill is intentionally limited to Chinese-language use. Under the language/locale policy, forcing a specific language without opt-in can be a natural-language policy issue unless the constraint is clearly documented and justified.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.