教学资源复用库

• Outcome: Review
• Latest audit: Oct 22, 2026 · 2:54 AM UTC
• Version: 2.12.0

Overview

This teaching resource library provides privacy controls, but its data schema requires more student information than its stated limits disclose.

Before using private student records, ask the publisher to align the schema with the advertised field limits and ensure the integration supplies only those fields. Use anonymized cases, approve sharing explicitly, and have teachers verify AI-generated exercises.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (6)

Incomplete referenced artifact analysis

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 42)May include surrounding context.

md

**版权**：每条资源必须有 `copyrightStatus`，取值只有 `shared/vocab.md §11` 的四档——`自有` / `改编` / `公开可引用` / `仅存索引`。**教辅原题与历年真题一律 `仅存索引`**，只记书名、页码、题号，不录入题干。禁止存储盗版扫描件与未授权转载的网络资源。

Incomplete referenced artifact analysis

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 229)May include surrounding context.

md

见 shared/vocab.md §1）

Incomplete referenced artifact analysis

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 314)May include surrounding context.

md

四档取值来自 `shared/vocab.md §11`，本 SKILL 不另设分类。

Incomplete referenced artifact analysis

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 550)May include surrounding context.

md

- `shared/vocab.md` — 版权四档、错因四维（唯一来源）

The shared hint ladder instructs the skill to provide full solutions and generate follow-up exercises, exceeding the resource library’s explicit no-question-generation scope.

Medium

• Category: Excessive Agency
• Confidence: 88% confidence

Finding

L27 requires explaining the original problem’s complete solution and having the student independently complete a similar problem generated using shared/ai-item-check.md. This is a direct tutoring and exercise-generation workflow, whereas the manifest explicitly says the skill does not generate questions and only stores, retrieves, and adapts teaching resources.

Content

No source excerpt is available for this finding.

The schema contradicts its claim that workspace records were reduced to the skill's declared subfields.

Medium

• Category: Excessive Agency
• Confidence: 97% confidence

Finding

The homeworkFollowup definition permits and requires fields such as task and status, although the declared read scope allows only mainErrors; similar overbroad definitions appear in lessonLogs and studentCards. If this schema is used to construct or validate the skill's input, it permits unnecessary student-linked information beyond the advertised scope, increasing privacy exposure in a resource-library workflow. The x-skill-scope annotations do not enforce access restrictions, although the supplied file alone does not establish that unauthorized access occurs at runtime.

Content

No source excerpt is available for this finding.