Security audit

教学资源复用库

Security checks for vulnerabilities and agentic risk

Overview

This teaching resource library is mostly transparent, but it can read student records from other skills without a clearly enforceable consent gate.

Review before installing in any workspace with real student records, especially minors. The main issue is not hidden code or exfiltration; it is that the skill's resource-matching feature can correlate existing student profile, homework, and lesson records without a schema-level way to verify cross-skill sharing consent. Install only if your platform enforces that consent outside this package, or after the schema is updated to expose and require the consent check before reads.

A.I.G

Vulnerability Patterns

Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (1)

T05 · Unauthorized Access and Privilege Escalation

Warning

Location: shared/solo-teacher-workspace.schema.json:14
Finding: Cross-Skill Student Data Access Lacks an Enforceable Consent Gate## Vulnerability Details **File Location**: `SKILL.md:436-442, 533`; `shared/solo-teacher-workspace.schema.json:14-42, 93-145`; `shared/vocab.md:113-126` **Vulnerability Type**: Missing authorization enforcement for cross-Skill access **Risk Level**: Medium ### Vulnerable Code Snippets `SKILL.md:436-442` declares access to persistent student records: ```text Read: workspace.studentCards[].alias / .gradeLevel / .gradeBand / .subjects / .goals / .primaryWeaknesses → Used to match resources by knowledge point and difficulty workspace.homeworkFollowups[].mainErrors[].knowledgePoint / .dimension → Used to locate questions and review scripts for current errors workspace.lessonLogs[].completedContent / .nextLessonFocus → Used to locate materials for the next lesson ``` `SKILL.md:533` requires a consent check: ```text Validation requirements: case resources must pass the anonymization check (§9.2) before storage; before cross-Skill sharing, confirm that `consent.crossSkillSharing` is true. Real names, contact details, and school information must never be written (see `SECURITY_BASELINE.md`). ``` `shared/vocab.md:113-126` defines cross-Skill sharing as default-deny: ```text | `crossSkillSharing` | Allows the minimum fields to be shared across Skills | false | ``` However, `shared/solo-teacher-workspace.schema.json:14-42` permits the data reads without exposing a consent field: ```json "reads": [ "homeworkFollowups", "lessonLogs", "studentCards" ], "fields": { "studentCards": { "reads": [ "gradeBand", "primaryWeaknesses", "alias", "gradeLevel", "subjects", "goals" ] }, "homeworkFollowups": { "reads": [ "mainErrors" ] }, "lessonLogs": { "reads": [ "completedContent", "nextLessonFocus" ] } } ``` The corresponding `studentCard` schema at `shared/solo-teacher-workspace.schema.json:9 ...[truncated 3371 chars]
Remediation: ## Remediation Suggestions 1. Add the applicable student consent object and `crossSkillSharing` field to the distributed schema and to `x-skill-scope.fields.studentCards.reads`. 2. Enforce an explicit check before reading or correlating records from other Skills: - Allow access only when `crossSkillSharing === true`. - Treat false, missing, malformed, or unavailable consent as denied. 3. Apply the consent check before fetching student cards, homework records, or lesson logs, rather than filtering only after the records have been loaded. 4. If the platform cannot safely expose the authorization field, remove these cross-Skill reads and require the teacher to provide the knowledge point, difficulty, and grade band in the current conversation. 5. Minimize output by avoiding student aliases and individualized weaknesses in recommendation explanations unless they are strictly necessary and authorized. 6. Add automated tests for true, false, absent, malformed, and revoked consent states. 7. Ensure consent revocation immediately prevents subsequent reads and invalidates cached or derived matching results. 8. Add the referenced `SECURITY_BASELINE.md` to the package or replace the dangling reference with an included security document.

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (7)

Description-Behavior Mismatch

Medium

Confidence: 92% confidence
Finding: The manifest explicitly limits the skill with '不联系家长', which sets an expectation that parent-related workflows are out of scope. However, the documentation later includes '家长话术' as a resource type, '家长沟通案例' as candidate content, and a '不要给家长看' control, showing the skill is designed to manage parent-facing communication materials despite the stated limitation.

Vague Triggers

Medium

Confidence: 91% confidence
Finding: Overly broad trigger phrases can cause the skill to activate unexpectedly during ordinary conversation, leading it to read or write resource-library data when the user did not intend to invoke it. In a skill that handles educational records and case libraries, accidental invocation increases the risk of unintended data exposure, modification, or privacy-affecting actions.

Intent-Code Divergence

Medium

Confidence: 95% confidence
Finding: At L168 the document states there is no '学员类型' field and that resources should be matched by knowledge point and difficulty instead. Later, the reuse flow includes '学员类型匹配？' as an evaluation criterion, which directly contradicts the earlier intent and guidance.

Natural-Language Policy Violations

Medium

Confidence: 98% confidence
Finding: The entire shared guidance file is written in Chinese and provides operational instructions only in that language, with no indication that users or downstream skill authors may choose another language. This creates a natural-language policy concern if the organization expects language choice rather than a forced locale.

Natural-Language Policy Violations

Medium

Confidence: 96% confidence
Finding: The document states the repository is designed for Mainland China Chinese K12 scenarios, with simplified Chinese phrasing and Mainland China default safety/help channels. This imposes a specific language/locale and regional default rather than offering user choice or opt-in, which matches the policy's language/locale violation category.

Natural-Language Policy Violations

Medium

Confidence: 96% confidence
Finding: The note text is written as a hard-coded Chinese-language instruction set, and the schema also uses Chinese-only descriptions and enums throughout. For a shared schema file, this imposes a specific language/locale without any opt-in, alternative locale, or documented region-specific justification, matching the natural-language locale policy concern.

Vague Triggers

Low

Confidence: 95% confidence
Finding: Broad deletion commands without clear scope constraints can be matched accidentally or ambiguously, causing unintended deletion of resource records or student-related case entries. Because the skill stores teaching resources and anonymized case data, mistaken deletion can result in irreversible data loss and undermine privacy-compliance workflows if the wrong records are removed.

Static analysis

No suspicious patterns detected.