Security audit

时空线索构建器

Security checks for vulnerabilities and agentic risk

Overview

This is a Chinese K12 history-study skill with disclosed, consent-gated profile and reminder features, and I did not find hidden execution, exfiltration, or destructive behavior.

Install this only for the intended Chinese K12 history-learning context, or localize the language, curriculum, crisis-support contacts, and minor-consent rules first. Review the profile and reminder controls with students or guardians because the skill can write limited learning-progress records when consent is enabled.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (7)

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 87% confidence
Finding: The description lists trigger examples such as "这几件事谁先谁后" and "这张历史地图怎么看", which are broad natural-language requests that could easily appear in ordinary conversation outside the intended skill-routing context. Although the file describes the skill domain, it does not provide negative examples or tighter activation constraints to distinguish when these phrases should or should not invoke this skill.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The schema's human-facing note and description are written entirely in Chinese, and many enum values and descriptions throughout the file also require Chinese-language values. For a general JSON schema distributed with a skill, this imposes a specific language/locale without any visible user choice or documented region-specific justification in the file.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The natural-language descriptions throughout the schema are written entirely in Chinese, and L014 presents the protocol as the canonical skill handover specification without offering any language or locale choice. Under the policy rules, a skill artifact that effectively requires a fixed language without opt-in can be a locale-policy violation unless it is clearly justified as region-specific.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The entire skill guidance is written as normative Chinese instructional content and does not indicate that users may choose another language or locale. Under the policy, forcing a specific language without opt-in is a natural-language policy violation unless the locale restriction is explicitly justified.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The document states that the library is designed for Mainland China Chinese K12 scenarios, with simplified Chinese phrasing and Mainland China help channels as defaults. This is a natural-language locale constraint that applies broadly, but the file does not present it as a user choice or opt-in within the skill behavior itself.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The entire shared vocabulary file is written exclusively in Chinese and establishes repository-wide mandatory terminology such as '全库统一词表' and '唯一术语与枚举来源'. Because it defines required language conventions for all dependent skills without offering any language choice or explaining a region-specific constraint, it constitutes a natural-language locale policy issue under the language/locale policy rule.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 88% confidence
Finding: This markdown file contains user-facing natural-language instructions exclusively in Chinese, with no indication that the user may choose another language or locale. Under the policy rule for language/locale constraints, forcing a specific language without opt-in can be a natural-language policy violation.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.