Security audit

英语综合测评

Security checks for vulnerabilities and agentic risk

Overview

This is a coherent Chinese K12 English assessment skill that handles student performance records with disclosed consent controls and no executable or hidden behavior.

Install this only for Chinese-speaking K12 English teachers or a localized equivalent. Before use, make sure teachers understand that student assessment data may be stored in the class workspace, use aliases rather than real names, and confirm any writeback or sharing of student-profile data.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (14)

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The metadata description embeds many natural-language trigger phrases such as “学员英语水平如何” and “英语综合测评怎么设计”, which are broad enough to match ordinary classroom discussion rather than an explicit request to invoke this skill. In an agent router, this can cause unintended activation, leading to context leakage, wrong tool selection, or unnecessary writes to the class workspace if the agent proceeds too eagerly.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The dedicated trigger section lists short, ambiguous phrases like “英语综合测评”, “学员能做什么”, and “学员英语弱” without clear exclusions or routing constraints. Because this skill can read and write classWorkspace data and coordinate with other skills, overbroad activation increases the chance of the wrong skill handling a request involving student performance or sensitive educational records.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: This markdown file is entirely presented in Chinese, beginning with the title at L001 and continuing throughout the template. Under the policy rule, forcing a specific language without opt-in or an explicit, justified regional constraint is a natural-language policy violation.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The template scope conflicts with the skill manifest: it is framed for upper-primary and junior-high students and explicitly anchors listening to the high-school entrance exam, while the skill metadata says the skill is for high-school assessment aligned to high-school standards. This mismatch can cause the agent to generate age- and standard-inappropriate assessments, leading to systematically invalid evaluation outputs and misleading learner profiles.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The file explicitly documents writing assessment-derived data into a class workspace and potentially back to a student profile, but only mentions an internal consent flag rather than a clear user-facing privacy notice, minimization rule, or handling guidance. Because this skill processes student performance data, the absence of explicit privacy safeguards can lead to unauthorized disclosure, over-collection, or inappropriate persistence of educational records.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: This markdown file contains user-facing skill instructions and rubric content only in Chinese, beginning with the title and continuing throughout the document. Under the policy rules, forcing a specific language without user opt-in can be a natural-language policy violation unless the locale constraint is explicitly documented and justified.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: This markdown file contains end-user instructional content solely in Chinese, and there is no natural-language indication that users may choose another language or that the skill is intentionally restricted to a Chinese-speaking audience. Under the language/locale policy, forcing a specific language without opt-in can be a policy violation.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The description is written as a normative policy for the workspace and includes only Chinese-language terminology and references, such as requiring the vocabulary in shared/vocab.md as the standard. For a schema distributed to a specific skill, this functions as a locale/language constraint, but there is no explicit user choice, opt-in, or documented justification that this schema is restricted to a Chinese-language regional context.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: Line L11 requires a specific Chinese explanation and references a China-specific guideline as the required rationale. This is a natural-language locale policy constraint that does not offer the user any language choice or indicate that the skill is only for a Chinese-language or region-specific context.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: L11 明确说明本库按“中国大陆的中文 K12 场景”设计，并将简体中文与中国大陆求助渠道设为默认。这属于自然语言层面的语言/地区约束；虽然 L13-L17 说明跨地区部署前需调整，但未体现对终端用户的语言/地区选择或 opt-in。
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Low

Category: Not specified by scanner
Confidence: 80% confidence
Finding: Line L008 states '不出等级' and says the template only outputs scores and micro-skill strengths and weaknesses, with level judgment left to the teacher against CSE descriptors. However, the report template later includes '长期：达到 [目标等级]' at L264, which introduces level-oriented output inconsistent with the earlier documentation's stated limitation.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 90% confidence
Finding: This markdown file is entirely written in Chinese and presents the guidance as the default operating language, but it does not state that the skill is Chinese-only or provide any user opt-in for language/locale. Under the policy, forcing a specific language without user choice can be a natural-language policy violation unless the locale constraint is explicitly documented and justified.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 87% confidence
Finding: The content appears to assume a Chinese-reading audience and provides no alternative language option or note that the skill is intentionally locale-specific. Under the policy, forcing a specific language without opt-in can be a natural-language policy concern unless clearly documented and justified.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The document title and all instructional content are written in Chinese, and the file does not indicate that users may choose another language or locale. Under the policy criteria, a skill artifact that imposes a specific language without user opt-in can be a natural-language policy violation.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.