Security audit

物理实验教学指导

Security checks for vulnerabilities and agentic risk

Overview

This is a Chinese K12 physics experiment teaching aid with disclosed student-data and safety limits, and I found no hidden code, exfiltration, or unsafe automatic behavior.

Install this for Chinese-language physics teaching contexts, especially China-mainland K12 curricula. Before using it elsewhere, localize curriculum assumptions, emergency contacts, data-consent rules, and lab safety requirements. Teachers should review all generated plans, report feedback, and workspace writebacks before using or storing them.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (16)

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The trigger phrases are extremely generic (for example, broad classroom-language patterns like '实验怎么教' and '数据怎么处理'), so the skill can activate in many ordinary education conversations beyond its intended scope. That can cause incorrect routing, over-collection of classroom context, and accidental invocation in situations where another skill or no skill should respond, which is a real security and safety boundary issue in agent ecosystems.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: This markdown skill reference forces a specific language/locale in its natural-language instructions and examples. Under the policy, language-specific behavior should either be user-selectable or clearly documented as a justified regional constraint, which is not present here.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 86% confidence
Finding: L006 明确写着“本 SKILL 不替老师给报告打分”，表示该技能不应承担评分职能。但后文 L203-L233 提供了具体分项打分和总分样板，这会把技能用途导向实际评分执行，而不只是教学组织或报告指导，形成文档内部的意图矛盾。
Content: No source excerpt is available for this finding.

Ae4

Medium

Category: analysis-evasion
Confidence: 80% confidence
Finding: Suspicious Unicode normalization or mixed-script content
Content: No source excerpt is available for this finding.

Ae4

Medium

Category: analysis-evasion
Confidence: 80% confidence
Finding: Suspicious Unicode normalization or mixed-script content
Content: No source excerpt is available for this finding.

Ae4

Medium

Category: analysis-evasion
Confidence: 80% confidence
Finding: Suspicious Unicode normalization or mixed-script content
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The natural-language note is written entirely in Chinese and describes the schema contract for distributed use, implying a Chinese-only operating context without any user language choice. Under the policy, forcing a specific language or locale without opt-in is a natural-language policy violation unless the locale constraint is explicitly documented and justified.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The description states that terminology must follow a shared Chinese vocabulary file and is fully presented in Chinese, but it does not indicate that this locale is optional or justified as a region-specific constraint. This creates a language policy concern because the file effectively mandates a specific language context.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: This markdown file presents all instructions and operational guidance only in Chinese, with no indication that users can choose another language or that the skill is intentionally limited to a Chinese-speaking context. Under the language/locale policy check, forcing a single language without user opt-in is a natural-language policy concern.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: This shared guidance is written entirely in Chinese and includes policy instructions for all SKILLs, including language-specific handling such as Chinese phrasing and references to Chinese educational guidance. There is no indication that users may choose another language or that the constraint is limited to a clearly documented China-specific deployment, which can violate language/locale choice expectations.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The file hard-codes a China-mainland Chinese K12 scope and states that, without localization work, it should not be directly used for students in other regions. While likely intended as a product-scoping constraint, it can still create a safety and equity issue if the skill is deployed more broadly: users may receive region-inappropriate guidance, legal assumptions, or emergency-contact behavior without an explicit user choice or locale check. In an education skill that may discuss student safety and crisis-routing conventions, incorrect regional defaults can materially degrade help quality.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The document defines the shared vocabulary entirely in Chinese and states it is the single source of truth for all skills, which effectively enforces a specific language/locale across the skill ecosystem. There is no indication that users can opt into another language or that this restriction is justified as a region-specific requirement.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 80% confidence
Finding: The skill description and instructions are entirely in Chinese, and there is no natural-language statement offering multilingual use or user opt-in for language preference. Under the policy, forcing a specific language without user choice can be a locale-policy issue unless the constraint is explicitly justified.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 91% confidence
Finding: This markdown file contains instructional content exclusively in Chinese and does not mention that the language is optional or selected by the user. Under the policy rule for natural-language violations, forcing a specific language without opt-in can be a locale/language policy issue.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 95% confidence
Finding: This markdown file contains user-facing instructional content exclusively in Chinese, and there is no indication that users can choose another language or that the skill is intentionally restricted to a Chinese-language audience. Under the policy criteria, forcing a specific language without user opt-in is a natural-language policy concern.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The document title and all instructional content are written exclusively in Chinese, but the file does not state that the skill is limited to Chinese-speaking users or that language selection is optional. Under the policy rule for language/locale constraints, this can be treated as a natural-language policy issue when no opt-in or justification is provided.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.