Security audit

阅读教学指导

Security checks for vulnerabilities and agentic risk

Overview

This is a teacher-facing Chinese reading-instruction skill with disclosed record and sharing controls, and I found no hidden code, remote payloads, or deceptive behavior.

Install this for Chinese-language K12 reading-teaching support, especially where teacher review and consent controls are available. Before deploying outside China-mainland Chinese K12 settings, localize language, curriculum assumptions, privacy rules, and crisis-support contacts, and configure routing so generic reading questions do not activate it without teacher-context confirmation.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (15)

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The skill description embeds multiple broad natural-language trigger phrases such as '这篇课文怎么讲' and '阅读理解怎么教' that are common in ordinary teaching conversations and not tightly scoped to an explicit skill invocation context. This can cause unintended activation, routing user data or workflow execution to this skill when the user may have intended a general chat response or a different education tool.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The dedicated trigger section enumerates ambiguous scenarios like '课文怎么讲', '学员读不懂怎么办', and '学员读得慢' without sufficient guardrails, exclusions, or disambiguation logic. In a multi-skill environment, this increases the chance of over-broad activation, especially because these phrases overlap with adjacent skills such as lesson planning, student analysis, classroom coaching, or even student/parent support flows.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 84% confidence
Finding: The document is entirely framed as a Chinese-language teaching template and explicitly ties usage to Chinese reading instruction, but it does not indicate that language choice is optional or limited by explicit user opt-in. Under the policy, forcing a specific language or locale without choice can be a natural-language policy violation unless clearly justified as region-specific.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The document title and all instructional content are written exclusively in Chinese, and the file presents itself as the authoritative source for the strategy cards. There is no indication that language selection is optional or that the Chinese-only constraint is a documented, justified regional requirement, which can violate language/locale choice policy.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The document is entirely presented in Chinese and identifies the instructional scope in Chinese without offering any language choice or noting that the skill is intended only for Chinese-speaking users. This can violate a language/locale policy when users are not given an opt-in or a documented justification for the locale constraint.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The document is entirely written as a mandatory repository-wide vocabulary and contract, with repeated normative language such as '统一' and '不得' that standardizes terminology in Chinese across all skills. Because it does not provide any user opt-in, alternative locale, or documented region-specific justification, this creates a natural-language locale policy constraint that may force a specific language without user choice.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 83% confidence
Finding: SQP-3 applies to all file types and covers language or locale policy violations. This reference file presents all instructional content exclusively in Chinese and does not indicate user opt-in, alternative language support, or a clearly documented region-specific limitation.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 82% confidence
Finding: The file is entirely written as a Chinese-only template and does not offer any alternative language or opt-in, which can be interpreted as a locale/language constraint. Under the policy, natural-language content that forces a specific language without user choice should be flagged unless the regional limitation is explicitly justified.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 84% confidence
Finding: This markdown file contains natural-language instructions exclusively in Chinese, including headings, workflow steps, and templates. Under the policy rule for language or locale constraints, forcing a single language without user opt-in can be a policy violation unless the restriction is explicitly justified.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 80% confidence
Finding: This markdown file presents its title and usage guidance only in Chinese, with no indication that users can choose another language. Under the policy, forcing a specific language without user opt-in can be a natural-language policy violation.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 91% confidence
Finding: This markdown file contains instructional content exclusively in Chinese and does not indicate that the user can choose another language or that the skill is intentionally limited to a Chinese-language audience. Under the policy rule for language or locale constraints, forcing a specific language without opt-in can be a natural-language policy issue.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 84% confidence
Finding: The note text is entirely in Chinese and describes the schema contract as tied to a Chinese-reading-teaching skill, with no indication that another language or locale is supported. Under the policy rule, forcing a specific language without opt-in is a natural-language locale constraint that should be documented or made optional.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The description states that terminology must follow "shared/vocab.md" and the surrounding text is Chinese-only, which imposes a fixed language/locale on downstream use. There is no explicit opt-in or justification in this file that the schema is intentionally region- or language-specific.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 78% confidence
Finding: Line L11 instructs the skill to use a specific Chinese sentence to explain why help is refused during an exam. This is a natural-language locale policy constraint because it prescribes one language without indicating that the user's preferred language should be used.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 91% confidence
Finding: L11 明确声明“本库按中国大陆的中文 K12 场景设计”，并将简体中文及中国大陆求助渠道设为默认。这属于语言/locale 限制，但文件随后在 L13-L17 明确说明跨地区部署前需先完成本地化与法规调整，构成了文档化且有理由的限制。
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.