Security audit

地理读图教练

Security checks for vulnerabilities and agentic risk

Overview

This is a Chinese K12 geography tutoring skill with disclosed, consent-gated profile and reminder handoffs and no executable code.

Install this only for the intended Chinese K12 geography tutoring context, or localize it before use elsewhere. Review the profile, sharing, parent visibility, and reminder consent settings because the skill can participate in learning-record handoffs when the user opts in.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (6)

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The schema's natural-language descriptions and enumerated values are entirely in Chinese, including user-facing consent labels and profile descriptions, with no indication that language is configurable or limited to a China-specific deployment. This can violate the language/locale policy when a skill or shared schema implicitly requires one language without user opt-in or explicit justification.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The entire shared skill file is written in Chinese and includes normative instructions for SKILL behavior, but there is no indication that the user may choose another language or that the skill is limited to a Chinese-speaking or region-specific deployment. Under the policy, forcing a specific language without user opt-in is a natural-language policy concern.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 83% confidence
Finding: The entire shared instruction file is written as normative guidance in Chinese and repeatedly specifies exact Chinese phrases the skill should use with students, such as the required one-sentence explanations in L11 and L34. There is no indication that the user may choose another language or locale, so this creates a natural-language policy risk if the skill is used in multilingual contexts.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The document states the repository is designed for Mainland China Chinese K12 scenarios, with simplified Chinese wording and Mainland China default support channels. Although it later describes what operators must do for other regions, the file still establishes a default locale/language policy rather than offering user choice or opt-in.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The schema's natural-language note is written entirely in Chinese and presents protocol guidance without offering any language or locale choice. Under the policy rule for all file types, this is a language/locale constraint that is not explicitly documented as region-specific or opt-in.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 87% confidence
Finding: The top-level description uses Chinese-only instructional text and establishes protocol semantics without indicating that Chinese is an intentional locale requirement. Because this file is a shared schema, the language choice appears mandatory rather than user-selectable.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.