Security audit

费曼学习法

Security checks for vulnerabilities and agentic risk

Overview

This is a coherent Chinese K12 learning skill with consent-gated memory and reminder handoffs, not hidden execution or data exfiltration.

Install this only for the intended Chinese K12 tutoring context. Check that the platform has consent controls enabled for learning records and reminders, and localize emergency-help guidance before use outside mainland China.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (8)

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The trigger section uses broad, natural-language phrases like '我觉得我懂了，你来测试一下我' and 'AI都讲明白了，我应该会了吧？' without strong exclusion or routing constraints. This can cause the skill to activate in contexts where the user is casually reflecting, discussing past events, or participating in another workflow, leading to unintended collection of learning-state signals, unnecessary challenge prompts, or interference with other skills.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The trigger list includes very broad phrases such as '帮我检验一下' and '我懂了想测试一下', which can plausibly appear in adjacent tutoring contexts and cause the skill to activate when the user did not specifically intend this workflow. In this skill, unintended activation is mainly a control-flow and UX safety issue rather than a direct security breach, but it can still lead to incorrect state transitions, unnecessary data handling, or bypass of a more appropriate subject-specific skill.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: This markdown file is entirely framed as a required protocol in Chinese, including required labels such as 【AI 生成，入库前请人工验算】, with no indication that users may choose another language. Under the policy, forcing a specific language without opt-in is a natural-language policy violation unless the locale restriction is clearly justified.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The enum restricts allowed values to Chinese strings only, which is a natural-language locale constraint embedded in the schema itself. The file does not indicate user opt-in, multilingual support, or a documented region-specific justification, so this can violate language/locale policy.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The entire skill guidance is written as normative instructions in Chinese and contains no indication that the assistant should adapt to the user's preferred language. Under the policy, forcing a specific language or locale without user opt-in is a natural-language policy violation.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: L11 明确声明“本库按中国大陆的中文 K12 场景设计”，并将示例、话术和求助渠道默认设为中国大陆。这构成了语言/地区默认约束；虽然 L13-L17 提到跨地区部署前需本地化，但这里仍未体现对最终用户的语言或地区选择/同意机制。
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 84% confidence
Finding: The entire shared vocabulary and normative instructions are written only in Chinese and function as a repository-wide contract for all skills. Because the file presents mandatory terminology and output conventions without offering a language choice or documenting a justified locale restriction, it creates a natural-language locale policy constraint.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 82% confidence
Finding: The document states the skill should maintain a natural 'curious elementary school student' role, and the file is entirely authored in Chinese with no indication that users can choose another language or interaction style. This creates a natural-language policy concern because it imposes a specific communication mode without explicit opt-in or documented justification.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.